Restore operation-specific messages in ServerAuthOperationError

The consolidation commit replaced individual error classes with
ServerAuthOperationError, which introduced a generic message getter:
'Server authentication operation ${operation} failed.'

Cloud HTTP handlers pass error.message into 500 response bodies via
failEnvironmentCloudInternalError, so this caused user-facing messages
to regress from specific strings like 'Could not verify the linked
cloud account.' to the generic template.

Restore the original per-operation messages through a lookup table
keyed by the operation discriminant.

Author: cursoragent

apps/server/src/auth/EnvironmentAuth.ts

@@ -90,6 +90,28 @@ const ServerAuthInternalOperation = Schema.Literals([
 ]);
 type ServerAuthInternalOperation = typeof ServerAuthInternalOperation.Type;
 
+const serverAuthOperationMessages: Record<ServerAuthInternalOperation, string> = {
+  validate_bootstrap_credential: "Failed to validate bootstrap credential.",
+  validate_session_credential: "Failed to validate session credential.",
+  issue_authenticated_session: "Failed to issue authenticated session.",
+  issue_authenticated_access_token: "Failed to issue authenticated access token.",
+  create_pairing_link: "Failed to create pairing link.",
+  list_pairing_links: "Failed to list pairing links.",
+  revoke_pairing_link: "Failed to revoke pairing link.",
+  issue_session_token: "Failed to issue session token.",
+  list_sessions: "Failed to list sessions.",
+  revoke_session: "Failed to revoke session.",
+  revoke_other_sessions: "Failed to revoke other sessions.",
+  issue_websocket_token: "Failed to issue websocket token.",
+  record_dpop_replay_state: "Failed to record DPoP proof replay state.",
+  calculate_dpop_replay_key: "Failed to calculate DPoP replay key.",
+  verify_linked_cloud_account: "Could not verify the linked cloud account.",
+  read_linked_cloud_account: "Could not read the linked cloud account.",
+  sign_cloud_link_jwt: "Failed to sign cloud link JWT.",
+  sign_cloud_health_jwt: "Failed to sign cloud health JWT.",
+  sign_cloud_mint_jwt: "Failed to sign cloud mint JWT.",
+};
+
 export class ServerAuthOperationError extends Schema.TaggedErrorClass<ServerAuthOperationError>()(
   "ServerAuthOperationError",
   {
@@ -98,7 +120,7 @@ export class ServerAuthOperationError extends Schema.TaggedErrorClass<ServerAuth
   },
 ) {
   override get message(): string {
-    return `Server authentication operation '${this.operation}' failed.`;
+    return serverAuthOperationMessages[this.operation];
   }
 }