fix(auth): explain headless refresh stage failures

[insane66613]

Problem / root cause

PR #363 preserves actionable browser infrastructure failures during explicit auth refresh, but several non-infrastructure headless failure stages still collapse to None. In particular, a saved managed browser profile that exists but is signed out produces only the generic "did not yield fresh credentials" result, which obscures the actual recovery step required.

Solution

When raise_on_error=True, surface safe AuthenticationError diagnostics for these headless refresh stages:

• missing managed browser profile
• NotebookLM page creation / DevTools websocket failure
• saved profile not signed in to NotebookLM
• NotebookLM page load timeout
• required NotebookLM cookies missing
• extracted credentials rejected by live NotebookLM validation

Automatic background recovery keeps the existing best-effort None behavior.

Verification

• 21 affected auth tests passed
• Ruff check passed
• Ruff format check passed
• git diff --check passed
• Added regressions for signed-out saved profiles, best-effort compatibility, and candidate rejection

Compatibility / risk

Low. The new errors are opt-in through the existing raise_on_error=True diagnostic mode. Normal automatic recovery behavior is unchanged.