fix(api): a session-store outage answers 503, not 401

Resolving a session cookie failed identically whether the credential was
missing or Postgres was unreachable: local_auth_enabled read errors fell into
the fail-closed 'disabled' branch and SessionUser errors into 'invalid
session', both surfacing as 401 'authentication required' — a lie that reads
as 'log in again' during an outage. Split the enabled-read into
(enabled, error), tag non-ErrNotFound store failures with errAuthBackend, and
map that to a new 503 auth_unavailable in requireExternal. Fail-closed is
unchanged: missing setting / bad value / missing session stay 401.

internal/api/errors.go

@@ -89,8 +89,13 @@ func newError(status int, code, format string, a ...any) *apiError {
 // Common errors reused across handlers.
 var (
 	errUnauthorized = newError(http.StatusUnauthorized, "unauthorized", "authentication required")
-	errForbidden    = newError(http.StatusForbidden, "forbidden", "not permitted")
-	errBadRequest   = newError(http.StatusBadRequest, "bad_request", "invalid request")
+	// errAuthUnavailable answers when the session store itself is unreachable
+	// (Postgres down): an outage is not a credential verdict, so the caller gets
+	// 503 "retry" instead of a 401 that reads as "log in again".
+	errAuthUnavailable = newError(http.StatusServiceUnavailable, "auth_unavailable",
+		"authentication is temporarily unavailable; retry shortly")
+	errForbidden  = newError(http.StatusForbidden, "forbidden", "not permitted")
+	errBadRequest = newError(http.StatusBadRequest, "bad_request", "invalid request")
 )
 
 // writeJSON writes v as an indented JSON body with the given status.