fix(lotus): LocalTransport must not re-wrap SFUTokenRefusedError

mapAuthErrorToUserFriendlyError turned every non-whitelisted error back into
FailToGetOpenIdToken, so lotus.5's refusal reason still surfaced as the
generic page (caught end-to-end with a routed 403 on /sfu/get). Pass it
through like the other user-facing auth errors. Unit-tested.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA

src/state/CallViewModel/localMember/LocalTransport.ts

@@ -26,6 +26,7 @@ import { type Epoch, type ObservableScope } from "../../ObservableScope.ts";
 import { Config } from "../../../config/Config.ts";
 import {
   FailToGetOpenIdToken,
+  SFUTokenRefusedError,
   MatrixRTCTransportMissingError,
   NoMatrix2AuthorizationService,
 } from "../../../utils/errors.ts";
@@ -261,7 +262,9 @@ async function doOpenIdAndJWTFromUrl(
 function mapAuthErrorToUserFriendlyError(e: unknown): Error {
   if (
     e instanceof FailToGetOpenIdToken ||
-    e instanceof NoMatrix2AuthorizationService
+    e instanceof NoMatrix2AuthorizationService ||
+    // [lotus] carries the token service's own refusal reason — keep it.
+    e instanceof SFUTokenRefusedError
   ) {
     // rethrow as is
     return e;