…inBoundary (#6897)

Follow-up feature on top of Epic [FR-2616](https://lablup.atlassian.net/browse/FR-2616). Jira ticket to be filed.

## Summary

Extends `STokenLoginBoundary` to handle two interactive auth challenges inline, without a modal and without splitting into separate components — the existing `DefaultErrorCard` layout stays, only its action area swaps per error kind.

### UX

| Error kind | Card status | Description | Actions |
|---|---|---|---|
| `totp-required` *(new)* | `warning` | "Enter the 6-digit code from your authenticator app…" | Inline OTP `<Input>` + **Submit** |
| `concurrent-session` *(activated)* | `warning` | "This account is already signed in somewhere else. Do you want to end the other session and continue here?" | **Copy details** · **Sign in anyway** |
| all other kinds | `error` | (unchanged) | **Copy details** · **Retry** |

On **Submit**, `STokenLoginBoundary` folds `otp: <entered>` into `extraParams` and replays the auth sequence. A failed retry re-renders the OTP card with an invalid-code hint above the input; the OTP itself is single-use (cleared after every retry).

On **Sign in anyway**, the boundary sets a sticky `forceApprovedRef` and replays the sequence with `force: true` folded in. Sticky matches LoginView's `forceLoginApprovedRef` — a TOTP challenge that arrives *after* a force approval keeps the force flag on the subsequent retries.

### Why

- `token_login` previously had a latent bug: `client.token_login` returns `{ fail_reason }` on `authenticated: false`, which is truthy, so the old `!loginSuccess` guard passed through and `connectViaGQL` ran against an unauthenticated client. Introducing `TokenLoginFailedError` fixes this at the helper layer before the classifier inspects it.
- Classification uses duck-typed field extraction (`err.failReason`, `err.failType`) rather than `instanceof TokenLoginFailedError` so cross-module-instance errors (Jest mocks, HMR reloads) classify identically to direct throws.
- String-match detection mirrors `LoginView.handleLoginError`'s legacy fallback so both entry points classify the same until the webserver surfaces the probe `type` through `client.token_login` (tracked by `TODO(user-tunable)`).

## Changes

- `react/src/helper/loginSessionAuth.ts`
  - `TokenLoginFailedError` class and structured throw from `tokenLogin`.
  - `extraParams` type widened to `Record<string, string | boolean>` so `force: true` can pass through alongside string URL params.
- `react/src/components/STokenLoginBoundary.tsx`
  - `STokenLoginError` union: `totp-required` added, `concurrent-session` wired up end-to-end.
  - `pendingOtpRef` (single-use) + `forceApprovedRef` (sticky) retry state.
  - `retryWithOtp` / `retryWithForce` handlers; existing `retry()` preserved for non-interactive kinds.
  - `DefaultErrorCard` gains `onSubmitOtp` / `onConfirmForce` plumbing and kind-branched action area. Card `status` shifts to `warning` for the two interactive kinds.
  - New `TotpInlineForm` subcomponent (kept co-located in the same file, per scope request).
- `resources/i18n/en.json`, `resources/i18n/ko.json`
  - `ErrorTotpRequiredTitle` / `ErrorTotpRequiredDescription` / `ErrorTotpInvalidHint` / `TotpPlaceholder` / `SubmitOtp` / `ForceLogin`.
  - `ErrorConcurrentSessionDescription` updated to match the new force-confirm UX.

## Test plan

- [x] `bash scripts/verify.sh` → `ALL PASS`
- [x] `pnpm --dir react jest src/components/STokenLoginBoundary.test.tsx` → 9 passed
- [ ] Manual: navigate `/?sToken=<TOTP-required>` → card shows OTP input, submit retries with `otp=…`. Wrong code surfaces invalid hint; right code proceeds.
- [ ] Manual: navigate with an active second-session setup → card offers "Sign in anyway"; confirming retries with `force=true`.
- [ ] Manual (combined): sToken where the server first issues `active-login-session-exists` then `require-totp-authentication` on the force retry → force flag stays on while OTP is submitted.

## Follow-ups

- File a Jira sub-task under Epic FR-2616 for this feature.
- Swap string-match classifier for strict `type` equality once `client.token_login` surfaces the probe `type` to the caller. `TokenLoginFailedError.failType` is already reserved.
- Translations for the 20 non-en/ko locales via the `fw:i18n` skill.

[FR-2616]: https://lablup.atlassian.net/browse/FR-2616?atlOrigin=eyJpIjoiNWRkNTljNzYxNjVmNDY3MDlhMDU5Y2ZhYzA5YTRkZjUiLCJwIjoiZ2l0aHViLWNvbS1KU1cifQ