[client] Improve error surfacing for restricted daemon sockets (#7704)

* Add probe for daemon restriction and improve error surfacing

client/ui/services/errors.go

@@ -112,6 +112,8 @@ func (c errorClassifier) classify(err error) *ClientError {
 
 	code := "unknown"
 	switch {
+	case grpcCode == gcodes.Unavailable && isSocketDenial(lower):
+		code = "daemon_access_denied"
 	case strings.Contains(lower, "token used before issued"),
 		strings.Contains(lower, "token is not valid yet"):
 		code = "jwt_clock_skew"
@@ -163,6 +165,15 @@ func (c errorClassifier) classify(err error) *ClientError {
 	}
 }
 
+// isSocketDenial reports whether a lowercased Unavailable message carries an OS
+// access denial on the daemon socket or pipe. "connect: permission denied" is
+// the Unix socket EACCES text and "access is denied" the Windows
+// ERROR_ACCESS_DENIED text; both matched on English OS messages.
+func isSocketDenial(lower string) bool {
+	return strings.Contains(lower, "connect: permission denied") ||
+		strings.Contains(lower, "access is denied")
+}
+
 // classifyDenial presents a refusal the daemon explained: a localised headline
 // for the reasons this build knows, with the daemon's own sentence as the
 // detail the frontend shows under it. An unrecognised reason keeps that sentence