fix handling of failed login as bad request

[mabiede]

No description provided.

[Copilot]

Pull request overview

This PR extends the web response error model with an explicit Unauthorized case and updates the public login POST flow to treat certain failures as unauthorized (redirecting to the login page while preserving intended destination and some form values).

Changes:

• Add Unauthorized to Http_response.http_error, plus unauthorized / unauthorized_on_error helpers.
• Update HTML error handling to support an unauthorized redirect flow (including intended URL + flash refill + X-Auth-Error header) and adjust AccessDenied to return 403 Forbidden.
• Switch public_login POST error mapping from “bad request” to the new “unauthorized” handling, and add a new Pool_message.Error.Unauthorized with EN/DE translations.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
pool/web/response/http_response.mli	Exposes Unauthorized and new helper functions in the response API.
pool/web/response/http_response.ml	Implements unauthorized redirect handling and refactors error response building.
pool/web/response/entity.ml	Extends http_error with Unauthorized and provides constructors/mappers.
pool/web/handler/public_login.ml	Changes login POST error handling to use unauthorized_on_error.
pool/pool_message/pool_message_error.ml	Adds a new Unauthorized error variant to the message error type.
pool/app/pool_common/locales/locales_en.ml	Adds EN translation for Unauthorized.
pool/app/pool_common/locales/locales_de.ml	Updates DE login-invalid wording and adds DE translation for Unauthorized.