Preserve auth failure detail in account/read workspace routing discovery

[shiny-code-app]

Problem

account/read workspace routing discovery discards the backend error. When GET /backend-api/wham/accounts/check returns HTTP 401 with code: token_revoked, the client only sees:

account/read failed: workspace routing discovery failed (code -32603)

The status code, error code, and "token was revoked, sign in again" meaning are all lost. Users can't tell a revoked login apart from a network outage or a backend bug.

Evidence

• Observed 2026-09-23 on v0.1.0-lab.8 (0e7f6ef41e), launching codex-lab from ~/Developer/codex-skills.
• Calling the same endpoint directly with the token from ~/.codex-lab/auth.json returned:
  • wham/accounts/check → 401 {"error":{"message":"Encountered invalidated oauth token for user, failing request","code":"token_revoked"}}
  • wham/usage → the same 401 token_revoked
• The local access token hadn't expired (its exp was 2026-10-01), so the server had revoked it.
• The ~/.codex token for the same account returned 200 at the same moment.
• After codex-lab login, both endpoints returned 200 and the TUI started normally.

Refs

• Error mapping that drops the cause: workspace_routing.rs#L126-L129 (.map_err(|_| internal_error("workspace routing discovery failed")))
• Request helper: backend-client/src/client.rs#L345-L356
• Introduced with upstream a4354e2d27 "Expose selected workspace routing in app-server account reads (Expose selected workspace routing in app-server account reads openai/codex#45529)".
• Related TUI behavior: Route revoked ChatGPT credentials to login instead of exiting during TUI bootstrap #963 (TUI bootstrap exits on this error instead of routing to login).

Finish Line

• A 401/403 from accounts/check reaches the account/read client as an auth failure the client can recognize, such as a distinct error message or structured error data. It must not look like a generic internal error.
• Non-auth failures still report their underlying cause (status or transport) without exposing tokens.
• Covered by an app-server test in workspace_routing_tests.rs.