fix: save typed credentials only after the connection succeeds, and re-ask when a saved one is rejected

A password typed at a 'saved' prompt was stored before the server
accepted it, so a typo was persisted and silently retried on every
reconnect. Typed values are now held per attempt and written once the
session connects; when the server refuses a saved credential the next
attempt asks again and the new value replaces it on success. A store
failure (keychain refused, vault locked) now shows a toast instead of
being swallowed, and reconnect prompts wait 5 minutes like the first
connect (SEC-20261012-015, F1, F2, F20).

rust/app/src/app.rs

@@ -466,6 +466,7 @@ impl App {
                     v.on_error(error);
                 }
             }
+            Event::Warning { message, .. } => self.s.error(message),
             Event::Irc { session, event } => {
                 if let Some(View::Irc(v)) = self.s.panes.get_mut(&session).map(|p| &mut p.view) {
                     v.on_event(event);
@@ -884,7 +885,7 @@ pub fn theme_for(pref: &str) -> ThemeKind {
 /// Recognises auth and host-key failures for the guided error dialog.
 pub fn classify_error(msg: &str) -> Option<(&'static str, &'static str, bool)> {
     let m = msg.to_lowercase();
-    if ["unable to authenticate", "authentication failed", "permission denied", "no supported methods"].iter().any(|p| m.contains(p)) {
+    if nexus_core::sessions::is_auth_error(&m) {
         return Some(("Authentication Failed", "The server rejected the provided credentials. Check username, password, keys, and auth methods.", false));
     }
     if ["host key", "fingerprint"].iter().any(|p| m.contains(p)) {