fix(client): map bare HTTP 401/403 to distinguishable JSON-RPC errors

[sgoel2be24-cyber]

Bare auth failures were collapsing into the generic "Server returned an error response" fallback, so agents could not handle operation-specific denials without tearing down the session. Surface Unauthorized/Forbidden with http_status metadata instead.

Fixes#1295

Motivation and Context

How Has This Been Tested?

Breaking Changes

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update

Checklist

• I have read the MCP Documentation
• My code follows the repository's style guidelines
• New and existing tests pass locally
• I have added appropriate error handling
• I have added or updated documentation as needed

Additional context

[cubic-dev-ai]

No issues found across 3 files

_{Re-trigger cubic}