Recognize mcp-go authorization-required sentinels as auth

[lorr1]

Closes #5223

Summary

The vMCP gateway emits a backend remains unhealthy WARN every 30s for
upstreamInject backends that are functionally fine. North hit 2780+
consecutive "failures" on github-copilot-entry — pure log noise, since
the backend is reachable and only fails because the background probe
carries no user credentials.

Root cause: mcp-go v0.49.0 added two sentinels for 401 responses
(transport.ErrAuthorizationRequired and
transport.ErrOAuthAuthorizationRequired). wrapBackendError did not
check for either, so the error fell through to ErrBackendUnavailable
and the health monitor categorized the probe as BackendUnhealthy. The
auth-aware fix from #4935 ("treat 401/403 from auth-configured backends
as healthy") therefore never engaged.

• Add typed errors.Is checks for both new mcp-go sentinels in
  wrapBackendError so production probes through BackendClient are
  correctly mapped to ErrAuthenticationFailed.
• Add "authorization required" to IsAuthenticationError as a
  fallback for paths where the typed sentinel is not preserved through
  the error chain (covers the integration-test path where a mock
  bypasses wrapBackendError, and any future Unwrap breakage).

With both in place, North’s upstream_inject backend reports
BackendHealthy (probe gets a nil error), the consecutive_failures
counter stays at 0, and the WARN spam stops. Misconfigured backends
(no outgoing auth strategy) continue to surface as
BackendUnauthenticated so operators see the diagnostic signal.

Type of change

• Bug fix

Test plan

• Unit tests (task test)
• Linting (task lint-fix)

Five new test sub-cases were added in a separate red commit before the
fix to lock in the regression:

• TestWrapBackendError: three sub-cases — ErrAuthorizationRequired,
  the wrapped production chain
  (transport.Error → *AuthorizationRequiredError), and
  ErrOAuthAuthorizationRequired — each must map to
  ErrAuthenticationFailed.
• TestHealthChecker_CheckHealth_AuthErrorsCategorizesAsUnauthenticated:
  the raw mcp-go chain reaching the checker classifies as
  BackendUnauthenticated when no outgoing auth strategy is configured.
• TestHealthChecker_CheckHealth_AuthErrorWithOutgoingAuthIsHealthy:
  upstream_inject + the raw mcp-go chain (Norths exact reproducer)
  classifies as BackendHealthy with nil error so the monitor
  records a successful check.

All five sub-cases were red on main (verified before commit 1) and
green after the fix.

Does this introduce a user-facing change?

WARN spam (backend remains unhealthy) for upstreamInject backends
that respond with 401/authorization required to no-credential probes
will stop. Backends previously misclassified as BackendUnhealthy
under these conditions will now be reported as BackendHealthy, and
the consecutive_failures counter will reset. No CRD or API changes.

Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 67.88%. Comparing base (8d9eb28) to head (a785fad).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #5225   +/-   ##
=======================================
  Coverage   67.87%   67.88%           
=======================================
  Files         610      610           
  Lines       62383    62389    +6     
=======================================
+ Hits        42340    42350   +10     
+ Misses      16871    16864    -7     
- Partials     3172     3175    +3     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.