fix(api): give the remaining 401 throws a code, and say what the code covers

Three refusals still answered 401 with prose alone: the Bearer re-read on
`/api/auth/me/sessions`, and the wrong-second-factor arm on both MFA step-up
routes. The shared 401 description told clients the code is the field to
branch on, so a client that took that advice landed in its default arm on all
three — and on the MFA pair that is the difference between re-prompting for a
digit and signing the user out over a typo.

The sessions re-read is the same missing-credential fact the gate already
names, so it reuses `auth.missing`. The MFA pair gets a code of its own,
`auth.mfa.code_invalid`: none of the existing ones fit, because every other
401 code asks the client to discard something, and this one asks it to keep
the session and try another code.

The description narrows to match what is actually true. The generic gates
name a reason; a route that checks a credential of its own — sign-in, the MFA
challenge exchange, a password confirmation — still answers 401 with prose,
and the text now says so instead of promising a field those responses do not
carry.

src/lib/api-errors.ts

@@ -55,6 +55,13 @@ export const AUTH_ERROR_CODES = {
   scope: "auth.scope.insufficient",
   /** Authenticated, but not an admin. Cookie-only surface; never a token. */
   admin: "auth.admin.required",
+  /**
+   * The second factor presented on a step-up flow did not verify — a wrong
+   * TOTP digit, a replayed one, or a recovery code that is spent. The session
+   * itself is untouched: the client re-prompts for a code rather than signing
+   * the user out, which is the opposite of what the other 401 codes ask for.
+   */
+  mfaCode: "auth.mfa.code_invalid",
 } as const;
 
 /**