Machine-readable auth failure codes for token and scope errors

[davidahmann]

Opened issue #2213 and PR #2214 to make HTTP auth failures easier to classify without parsing free-form strings. The branch adds JSON {error, code} bodies for missing-token, invalid-token, and insufficient-scope responses, propagates the same classification into GitHub API error wrappers, and adds regression tests plus doc updates. Local validation: go test ./pkg/http/middleware ./pkg/errors passed.

Inspired by research context: CAISI publishes independent, reproducible AI agent governance research: https://caisi.dev