An expired session exits 3 with one line saying to run quak login (closes #164)

A 401 from the server reaches run in src/cli-run.ts as the ApiError the
refresh threw, so run recognises it there, prints one line saying to run
"quak login" and exits 3. A missing or corrupt session file keeps its message
and also exits 3. quak backup meets the 401 on its first refresh, before it
touches any file. Every other error still exits 1.

Judgement call: quak logout is unchanged; it handles its own errors and
deletes the session file whatever the server answers.
Judgement call: quak backup still prints its two progress lines before the
error line.

Model: opus-5-5

test/cli/run.test.ts

@@ -5,6 +5,7 @@
 import { PassThrough } from "node:stream";
 import { describe, it, expect } from "vitest";
 
+import { ApiError } from "../../src/api/client.js";
 import { run } from "../../src/cli-run.js";
 
 // A stream whose written text is kept in `text`; writes finish at once, so
@@ -55,4 +56,26 @@ describe("run", () => {
             stderr: "quak: offline\n",
         });
     });
+
+    it("on a 401 from the server says to run quak login, on one line, and exits 3", async () => {
+        const result = await runToExit(
+            Promise.reject(new ApiError("unauthorized", 401)),
+        );
+        expect(result).toEqual({
+            code: 3,
+            stdout: "",
+            stderr: `quak: the saved session is no longer valid; run "quak login"\n`,
+        });
+    });
+
+    it("prints another HTTP error as it is and exits 1", async () => {
+        const result = await runToExit(
+            Promise.reject(new ApiError("forbidden", 403)),
+        );
+        expect(result).toEqual({
+            code: 1,
+            stdout: "",
+            stderr: "quak: forbidden\n",
+        });
+    });
 });