fix(api,web): corrections auth — gestion d'erreur login, messages explicites

- web: auth/errors (+ tests), LoginPage, client API
- api: auth controller/service

Refs: #14

apps/web/src/api/client.ts

@@ -30,10 +30,32 @@ export class ApiFallbackError extends Error {
   }
 }
 
+export class ApiHttpError extends Error {
+  constructor(
+    public readonly status: number,
+    message: string
+  ) {
+    super(message);
+  }
+}
+
 export function getApiFallback<T>(error: unknown): T | undefined {
   return error instanceof ApiFallbackError ? (error.fallback as T) : undefined;
 }
 
+function apiErrorMessage(detail: string, fallback: string): string {
+  if (!detail) return fallback;
+  try {
+    const parsed = JSON.parse(detail) as { message?: unknown; error?: unknown };
+    if (typeof parsed.message === "string") return parsed.message;
+    if (Array.isArray(parsed.message)) return parsed.message.join(", ");
+    if (typeof parsed.error === "string") return parsed.error;
+  } catch {
+    return detail;
+  }
+  return fallback;
+}
+
 async function request<T>(path: string, options: RequestOptions = {}): Promise<T> {
   try {
     const response = await fetch(`${API_BASE}${path}`, {
@@ -50,7 +72,7 @@ async function request<T>(path: string, options: RequestOptions = {}): Promise<T
         window.dispatchEvent(new CustomEvent("readabook:session-expired"));
       }
       const detail = await response.text();
-      throw new Error(detail || `${response.status} ${response.statusText}`);
+      throw new ApiHttpError(response.status, apiErrorMessage(detail, `${response.status} ${response.statusText}`));
     }
 
     return (await response.json()) as T;