fix(client): map bare HTTP 401/403 to distinguishable JSON-RPC errors

[sgoel2be24-cyber]

Bare auth failures were collapsing into the generic "Server returned an error response" fallback, so agents could not handle operation-specific denials without tearing down the session. Surface Unauthorized/Forbidden with http_status metadata instead.

Fixes #1295

Motivation and Context

How Has This Been Tested?

Breaking Changes

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update

Checklist

• I have read the MCP Documentation
• My code follows the repository's style guidelines
• New and existing tests pass locally
• I have added appropriate error handling
• I have added or updated documentation as needed

Additional context

[cubic-dev-ai]

No issues found across 3 files

_{Re-trigger cubic}

[sgoel2be24-cyber]

Thanks — noting the relationship to #3278.

#3278 correctly treats hang/teardown (#2110) as orthogonal to status-code distinguishability. This PR remains scoped to the residual #1295 ask: bare 401/403 should surface as Unauthorized/Forbidden (with http_status metadata) instead of the generic "Server returned an error response".

Happy to rebase onto the new status_error_data() helper as soon as #3278 lands, so the 401/403 mapping lives in that single place rather than inline in _handle_post_request.

[github-actions]

Thanks for the contribution. This repository only keeps pull requests open when they're linked to an issue that a maintainer has assigned to the author — CONTRIBUTING.md explains why and how we work. This PR has been closed for now because you aren't currently assigned to #1295.

If a maintainer would like this change as a PR from you, they'll assign you to #1295 and this PR will reopen automatically — there's nothing more you need to do. (If you opened the issue, this PR already shows up on its timeline.)

There's no need to open a new PR — this one will be reopened. While it's closed, please push any updates as new commits rather than force-pushing, since GitHub can't reopen a PR whose branch has been rewritten.

Maintainers: reopening this PR, removing the missing-issue-link label, or adding bypass-issue-check bypasses the check.