auth: surface contexts read errors; cleaner not-logged-in UX

Address two review comments:

• ResolveControlPlaneTarget already failed loud on a contexts.json read/parse error; make auth status (resolveStatusTarget) symmetric — surface a genuine load error instead of swallowing it into the legacy fallback. A missing file still reads as "no contexts" (not an error), so this only fires on real corruption/IO failure, which the user must see before a control-plane mutation acts as a stale identity.

• providerSource.BearerAuth no longer prefixes the active-context error. NewRefreshingLoginProvider already returns a tailored message naming the context, its login server, and the exact re-login command; surface it verbatim. The bare ErrNotLoggedIn sentinel (static fallback path) still gets the standard 'entire login' hint.