[client] Classify session extend errors for the UI

Route services.Session errors through the same classifier Connection
uses so RequestExtend/WaitExtend return a structured ClientError with a
clean localized short message instead of the raw daemon error. Extract
the shared errorClassifier into errors.go, and fall back to the gRPC
status code when no message substring matches, since the daemon now
forwards a clean desc without the English marker text.

client/ui/services/session.go

@@ -19,20 +19,30 @@ type (
 // Session wraps authsession.Session, exposing only the subset the React frontend
 // calls; the tray uses authsession.Session directly, keeping the generated TS surface minimal.
 type Session struct {
-	inner *authsession.Session
+	inner      *authsession.Session
+	classifier errorClassifier
 }
 
 // NewSession wraps inner; the caller retains ownership and may use it directly.
-func NewSession(inner *authsession.Session) *Session {
-	return &Session{inner: inner}
+// translator or prefs may be nil, in which case errors fall back to the bare code key.
+func NewSession(inner *authsession.Session, translator ErrorTranslator, prefs LanguagePreference) *Session {
+	return &Session{inner: inner, classifier: errorClassifier{translator: translator, prefs: prefs}}
 }
 
 // RequestExtend starts the SSO session-extension flow; the result carries the verification URI to open.
 func (s *Session) RequestExtend(ctx context.Context, p ExtendStartParams) (ExtendStartResult, error) {
-	return s.inner.RequestExtend(ctx, p)
+	res, err := s.inner.RequestExtend(ctx, p)
+	if err != nil {
+		return ExtendStartResult{}, s.classifier.classify(err)
+	}
+	return res, nil
 }
 
 // WaitExtend blocks until the RequestExtend flow completes; the deadline is nil when the peer is ineligible.
 func (s *Session) WaitExtend(ctx context.Context, p ExtendWaitParams) (ExtendResult, error) {
-	return s.inner.WaitExtend(ctx, p)
+	res, err := s.inner.WaitExtend(ctx, p)
+	if err != nil {
+		return ExtendResult{}, s.classifier.classify(err)
+	}
+	return res, nil
 }