feat(errors): typed errors with status and URL for error responses

[PhilflowIO]

Closes #42

What

New errors (src/util/authError.ts, exported from the package root):

• DAVResponseError: a subclass of Error with code: 'TSDAV_RESPONSE_ERROR', status and url. isDAVResponseError checks the class or the code.
• DAVAuthenticationError: a subclass of DAVResponseError with code: 'TSDAV_AUTHENTICATION_FAILED'. isDAVAuthenticationError checks the class or the code.
• Checking the code as well means both guards still work when a bundler loads two copies of tsdav.

Where they are thrown. Messages are unchanged everywhere; any of these answered with 401 throws DAVAuthenticationError instead:

• assertDAVResponses, used by calendar and address-book discovery (Calendar discovery failed: …)
• assertDAVProperty
• collectionQuery
• isCollectionDirty
• fetchPrincipalUrl: a 403 now keeps its status
• fetchHomeUrl

OAuth:

• getOauthHeaders adds failure: { status, url } to its result when the token endpoint answers with an error status. On success it returns exactly the fields it did before.
• The client throws DAVAuthenticationError for a token endpoint answering 400 or 401 (RFC 6749 5.2), and DAVResponseError with the status for anything else (429, 404, 5xx).
• The return values of fetchOauthTokens and refreshAccessToken are unchanged.

Elsewhere:

• createAccount keeps a credentials error across root-URL candidates by its type; it used to check message.startsWith('Invalid credentials').
• Documented in docs/docs/helpers/authHelpers.md. CHANGELOG has an Unreleased section. Version and tag are left to the release.

Why

dav-mcp (PhilflowIO/dav-mcp#134) needs to tell a wrong password from a forbidden resource, a rate limit, a wrong URL or a server failure, without reading message text. That holds at login and later on, e.g. when an OAuth refresh token expires mid-session. Against Baïkal a 401 on /dav.php/ is followed by a 405 on the server root, so only the thrown error knows the login was refused.

Tests

• src/__tests__/unit/authError.test.ts covers:
  • the exports, and the guards recognising a copy by its code
  • fetchPrincipalUrl: 401 is an auth error with the unchanged message; 403 is a DAVResponseError 403 with the unchanged message
  • createAccount with 401 followed by 405 (Baïkal): typed 401
  • assertDAVResponses with 401, 403 and 500
  • collectionQuery with 401
  • token endpoint: 400 on refresh and 400 on the authorization-code grant are auth errors; 429, 404 and 503 are DAVResponseErrors
  • getOauthHeaders on success: same fields as before
• pnpm test: 27 files / 443 tests passed. pnpm typecheck, pnpm lint, pnpm test:examples and pnpm test:consumer all pass.
• The committed dist/ matches a fresh pnpm build.
• Not run: the live provider suites. dav-mcp ran live against Baïkal with this build.