[client] Name only the refusals, not every FailedPrecondition

The classifier gained a blanket FailedPrecondition -> change_refused fallback
so a refusal would stop reading as "Operation failed". It reaches too far:
the daemon returns that code for two dozen states that are not settings
refusals — "not logged in", "client is not running", "another capture is
already running", "session can no longer be extended, log in again to
reconnect" — and errorClassifier is shared with the session and connection
services, not just the settings save.

So the user was told the service had refused their change while what they
actually had to do was log in again. The two refusals the daemon composes
stay named by their message; everything else goes back to the generic
message, which says nothing rather than something wrong.

Reported by cubic on the PR.

client/ui/services/errors_test.go

@@ -50,10 +50,11 @@ func TestErrorClassifier_Classify(t *testing.T) {
 		require.Equal(t, "settings_managed_by_mdm", c.classify(err).Code)
 	})
 
-	t.Run("any other refusal is still a refusal", func(t *testing.T) {
-		// FailedPrecondition means the daemon answered and declined; falling
-		// through to "unknown" showed "Operation failed" instead.
-		require.Equal(t, "change_refused", c.classify(gstatus.Error(gcodes.FailedPrecondition, "something else")).Code)
+	t.Run("an unrelated FailedPrecondition is not called a refusal", func(t *testing.T) {
+		// The daemon uses this code for states that are not settings refusals,
+		// and this classifier is shared with the session and connection
+		// services, so only the two refusals it composes are named.
+		require.Equal(t, "unknown", c.classify(gstatus.Error(gcodes.FailedPrecondition, "not logged in")).Code)
 	})
 
 	t.Run("unavailable code maps to daemon_unreachable", func(t *testing.T) {