fix(lotus): show the SFU token service's refusal reason instead of "Something went wrong"

When the voice-limit guard (or any JWT service) answers 403 with a reason —
"This voice channel is full.", "You don't have permission to …" — EC wrapped it
in FailToGetOpenIdToken and the user saw the generic error page with
OPEN_ID_ERROR. A 403 MatrixError with a non-empty `error` now throws
SFUTokenRefusedError ("Can't join this call" + the server's sentence), so the
reason is the description. Other failures are unchanged. Unit-tested.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA

src/livekit/openIDSFU.test.ts

@@ -20,7 +20,7 @@ import { MatrixError } from "matrix-js-sdk";
 import { getSFUConfigWithOpenID, type OpenIDClientParts } from "./openIDSFU";
 import { testJWTToken } from "../utils/test-fixtures";
 import { ownMemberMock } from "../utils/test";
-import { FailToGetOpenIdToken } from "../utils/errors";
+import { FailToGetOpenIdToken, SFUTokenRefusedError } from "../utils/errors";
 
 const sfuUrl = "https://sfu.example.org";
 
@@ -91,6 +91,31 @@ describe("getSFUConfigWithOpenID", () => {
     expect.fail("Expected test to throw;");
   });
 
+  it("[lotus] surfaces a 403 refusal's reason instead of the generic error", async () => {
+    fetchMock.post("https://sfu.example.org/sfu/get", () => {
+      return {
+        status: 403,
+        body: { errcode: "M_FORBIDDEN", error: "This voice channel is full." },
+      };
+    });
+    try {
+      await getSFUConfigWithOpenID(
+        matrixClient,
+        ownMemberMock,
+        "https://sfu.example.org",
+        "!example_room_id",
+      );
+    } catch (ex: unknown) {
+      expect(ex).toBeInstanceOf(SFUTokenRefusedError);
+      expect((ex as SFUTokenRefusedError).localisedMessage).toEqual(
+        "This voice channel is full.",
+      );
+      void (await fetchMock.flush());
+      return;
+    }
+    expect.fail("Expected test to throw;");
+  });
+
   it("should retry without delay params if the JWT service legacy endpoint returns M_BAD_JSON 400", async () => {
     let callCount = 0;