fix(lotus): show the SFU token service's refusal reason instead of "Something went wrong"

When the voice-limit guard (or any JWT service) answers 403 with a reason —
"This voice channel is full.", "You don't have permission to …" — EC wrapped it
in FailToGetOpenIdToken and the user saw the generic error page with
OPEN_ID_ERROR. A 403 MatrixError with a non-empty `error` now throws
SFUTokenRefusedError ("Can't join this call" + the server's sentence), so the
reason is the description. Other failures are unchanged. Unit-tested.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA

src/livekit/openIDSFU.ts

@@ -8,6 +8,7 @@ Please see LICENSE in the repository root for full details.
 import {
   type IOpenIDToken,
   type MatrixClient,
+  MatrixError,
   parseErrorResponse,
 } from "matrix-js-sdk";
 import { type CallMembershipIdentityParts } from "matrix-js-sdk/lib/matrixrtc/EncryptionManager";
@@ -16,6 +17,7 @@ import { type Logger } from "matrix-js-sdk/lib/logger";
 import {
   FailToGetOpenIdToken,
   NoMatrix2AuthorizationService,
+  SFUTokenRefusedError,
 } from "../utils/errors";
 import { doNetworkOperationWithRetry } from "../utils/matrix";
 import { Config } from "../config/Config";
@@ -165,6 +167,14 @@ export async function getSFUConfigWithOpenID(
     logger?.info(`Got JWT from call's active focus URL.`);
     return extractFullConfigFromToken(sfuConfig);
   } catch (ex) {
+    // [lotus] A 403 from the token service carries the reason the user needs
+    // ("This voice channel is full.") — surface it instead of the generic error.
+    if (ex instanceof MatrixError && ex.httpStatus === 403) {
+      const reason = (ex.data as { error?: unknown } | undefined)?.error;
+      if (typeof reason === "string" && reason.trim()) {
+        throw new SFUTokenRefusedError(reason, ex);
+      }
+    }
     throw new FailToGetOpenIdToken(
       ex instanceof Error ? ex : new Error(`Unknown error ${ex}`),
     );