[wsj040303]

What type of PR is this?

• bug fix

What this PR does and why

When Console cannot read an IAM user from Kubernetes, sign-in currently reports incorrect credentials before checking the password. Authenticator.Login turns every user-read error into ErrAuth, and the web client treats every unsuccessful token response as a password error.

Only a missing user now becomes a credential failure; other lookup errors retain their cause and use the existing 500 server_error response. The cause stays in server logs and the login audit records a service failure. Unknown users and wrong passwords still receive the same generic 401 invalid_grant response.

The login page reserves the incorrect-credentials message for that response. Service errors, network failures and unusable token responses show recovery guidance in English and Chinese without storing a token or exposing the response body. No endpoint, configuration key or credential format is added.

Which issue(s) this PR fixes

Fixes #122

How it was tested

• Before the fix: existing IAM/server suites and 594 web tests passed. Added regressions produced 9 failing backend cases and 26 failing web cases.
• go test ./...: 175 tests/subtests passed; 6 existing Helm-dependent cases skipped because chart dependencies were not fetched. No chart changes.
• go test -race ./internal/iam ./internal/server, go vet ./..., and gofmt passed.
• In web/: npm run typecheck (both variants), npm test (624 tests), and npm run build passed.
• Chromium: service errors, invalid credentials and network disconnects in both languages, before and after; no page exceptions or token cookies on failed login. Kubernetes errors use fake clients and browser responses use isolated fixtures; no live cluster or VPN deployment was used.

Locale	Before: service error	After: service error
English
简体中文

Checks

• go test ./... and gofmt -l . is empty (Helm skips noted above)
• npm run typecheck && npm test && npm run build in web/
• Login failure behavior documented in docs/console-design.md
• No internal hostnames, IPs, registries or credentials
• Chart lint is not applicable; no chart changes.

Notes for reviewers

Start with the distinction between a missing user and a failed user lookup. The existing server_error wire response remains generic; Kubernetes authentication/RBAC errors must not be presented as a user's bad password. Identity changes require the additional reviewer described in the contribution guide.

Release note

Sign-in now distinguishes unavailable login services from incorrect credentials and provides network/VPN recovery guidance in Chinese and English.