fix: an error should say what the server said

[hugo8xx]

For 401, 402, 404 and 429 the client replaced the server's message with a canned hint and dropped the rest:

return {
    401: "unauthorized — bad or missing API key",
    ...
}.get(status, text[:300])

That removes the only part that tells causes apart. A 401 for a credential that was rejected read exactly like a 401 for one that never arrived — the engine distinguishes them (Invalid bearer token vs Missing credentials) and the client threw that away.

After

unauthorized — bad or missing API key (Invalid API key)
unauthorized — the OAuth token was rejected or missing; it may have expired,
  in which case authorize again (Invalid bearer token)

The hint stays, because it is the useful half. The server's own words follow it.

The 401 hint depends on the credential

An OAuth-authenticated caller has no API key to check, so sending them to look for one is a wrong turn rather than a vague one.

That happened today: a model read "bad or missing API key" from a remote MCP server and dutifully advised setting KHWAN_API_KEY — on a path that has never used one, and where the real question was whether the token had expired.

6 new tests, 41 passing.