[client] Fail netbird up when the daemon refuses the settings update

With the update-settings kill switch on, `netbird up --enable-rosenpass`
connected and said almost nothing: SetConfig refused the change, the CLI
downgraded that to a warning, and Login carries no rosenpass field to apply, so
the flag was silently dropped. The setting stayed disabled, which is the point
of the switch, but the caller was never told their request had been ignored.

The refusal now travels as codes.FailedPrecondition instead of
codes.Unavailable, and the CLI fails on it. Unavailable means "the daemon
cannot serve this call", which is why the CLI downgraded it and why
client/ui/services reads it as an unreachable daemon — both wrong for a daemon
that answered and refused. FailedPrecondition also matches what the MDM gate
already returns for a managed field, so both refusals are now one class of
error, and it is added to the login backoff's early-exit codes so a refused
login stops instead of retrying for 30s.

This does not put the container back in the deadlock: with the value-aware
gate, a client restating its own configuration is not refused at all, so
nothing reaches this path unless a real change was asked for.

client/server/server.go

@@ -59,6 +59,11 @@ const (
 
 	errRestoreResidualState   = "failed to restore residual state: %v"
 	errProfilesDisabled       = "profiles are disabled, you cannot use this feature without profiles enabled"
+	// errUpdateSettingsDisabled is returned with codes.FailedPrecondition, not
+	// codes.Unavailable: the daemon answered, and it refused. Unavailable means
+	// "the daemon cannot serve this", which is why the CLI downgrades it to a
+	// warning and the GUI reads it as an unreachable daemon — both wrong for a
+	// refusal the caller has to act on.
 	errUpdateSettingsDisabled = "update settings are disabled, you cannot use this feature without update settings enabled"
 	errNetworksDisabled       = "network selection is disabled by the administrator"
 )
@@ -488,7 +493,7 @@ func (s *Server) SetConfig(callerCtx context.Context, msg *proto.SetConfigReques
 	// their login too, which left a client configured by environment
 	// (NB_MANAGEMENT_URL and friends) unable to come up at all.
 	if s.checkUpdateSettingsDisabled() && configChangeRequested(stored, config) {
-		return nil, gstatus.Errorf(codes.Unavailable, errUpdateSettingsDisabled)
+		return nil, gstatus.Errorf(codes.FailedPrecondition, errUpdateSettingsDisabled)
 	}
 
 	// MDM gate: refuse the whole request if any of its fields is enforced
@@ -648,7 +653,7 @@ func (s *Server) Login(callerCtx context.Context, msg *proto.LoginRequest) (*pro
 	// that is what keeps a re-login, or a container restart carrying
 	// NB_MANAGEMENT_URL, working with the kill switch on.
 	if s.checkUpdateSettingsDisabled() && configChangeRequested(stored, loginOverridesInput(msg)) {
-		return nil, gstatus.Errorf(codes.Unavailable, errUpdateSettingsDisabled)
+		return nil, gstatus.Errorf(codes.FailedPrecondition, errUpdateSettingsDisabled)
 	}
 
 	policy := loadMDMPolicy()
@@ -2663,7 +2668,7 @@ func (s *Server) authorizeAndPrepareLogin(callerCtx context.Context, msg *proto.
 	// authoritative check, and it is the last read before persistLoginOverrides
 	// writes.
 	if s.checkUpdateSettingsDisabled() && configChangeRequested(stored, loginOverridesInput(msg)) {
-		return nil, nil, gstatus.Errorf(codes.Unavailable, errUpdateSettingsDisabled)
+		return nil, nil, gstatus.Errorf(codes.FailedPrecondition, errUpdateSettingsDisabled)
 	}
 
 	s.mutex.Lock()

client/server/update_settings_gate_test.go

@@ -62,7 +62,7 @@ func TestSetConfig_ChangingASettingIsRefused(t *testing.T) {
 		ManagementUrl: "https://mgmt.elsewhere.example:443",
 	})
 	require.Error(t, err, "moving the management URL is a settings change")
-	require.Equal(t, codes.Unavailable, gstatus.Code(err), "want the update-settings refusal, got %v", err)
+	require.Equal(t, codes.FailedPrecondition, gstatus.Code(err), "want the update-settings refusal, got %v", err)
 
 	cfg, err := profilemanager.GetExistingConfig(cfgPath)
 	require.NoError(t, err)
@@ -83,7 +83,7 @@ func TestSetConfig_SingleDivergingFieldIsRefused(t *testing.T) {
 		RosenpassEnabled: &rosenpass,
 	})
 	require.Error(t, err, "enabling Rosenpass is a settings change")
-	require.Equal(t, codes.Unavailable, gstatus.Code(err), "want the update-settings refusal, got %v", err)
+	require.Equal(t, codes.FailedPrecondition, gstatus.Code(err), "want the update-settings refusal, got %v", err)
 }
 
 // With the switch off, the same diverging request goes through: the gate must
@@ -119,7 +119,7 @@ func TestLogin_ChangingTheManagementURLIsRefused(t *testing.T) {
 		ManagementUrl: "https://mgmt.elsewhere.example:443",
 	})
 	require.Error(t, err, "moving the management URL through Login is a settings change")
-	require.Equal(t, codes.Unavailable, gstatus.Code(err), "want the update-settings refusal, got %v", err)
+	require.Equal(t, codes.FailedPrecondition, gstatus.Code(err), "want the update-settings refusal, got %v", err)
 
 	// "Refused before it can touch daemon state" is the contract, so check the
 	// state as well as the error.
@@ -252,7 +252,7 @@ func TestSetConfig_RefusedRequestLeavesTheConfigFileUntouched(t *testing.T) {
 		ManagementUrl: "https://mgmt.elsewhere.example:443",
 	})
 	require.Error(t, err)
-	require.Equal(t, codes.Unavailable, gstatus.Code(err), "want the update-settings refusal, got %v", err)
+	require.Equal(t, codes.FailedPrecondition, gstatus.Code(err), "want the update-settings refusal, got %v", err)
 
 	after, err := os.ReadFile(cfgPath)
 	require.NoError(t, err)
@@ -305,7 +305,7 @@ func TestLogin_RestatingTheStoredConfigPassesTheGate(t *testing.T) {
 		ManagementUrl: storedManagementURL,
 	})
 	if err != nil {
-		require.NotEqual(t, codes.Unavailable, gstatus.Code(err),
+		require.NotEqual(t, codes.FailedPrecondition, gstatus.Code(err),
 			"the gate refused a login that changes nothing: %v", err)
 		require.NotContains(t, err.Error(), "update settings are disabled",
 			"the gate refused a login that changes nothing: %v", err)
@@ -352,7 +352,7 @@ func TestLogin_ChangeThatAppearsMidRequestIsRefused(t *testing.T) {
 		ManagementUrl: storedManagementURL,
 	})
 	require.Error(t, err, "the login became a settings change before it was written")
-	require.Equal(t, codes.Unavailable, gstatus.Code(err), "want the update-settings refusal, got %v", err)
+	require.Equal(t, codes.FailedPrecondition, gstatus.Code(err), "want the update-settings refusal, got %v", err)
 	require.False(t, cancelled, "the refused login cancelled the login already in progress")
 
 	stored, err := profilemanager.GetExistingConfig(targetPath)