fix(grpc): return 401 for unauthenticated v1 gateway errors (#11786)

Fixes #11730

The v1 gRPC middleware can return native gRPC status errors such as
`codes.Unauthenticated` when the auth header is missing.

Those errors were being passed through the generic gRPC error converter,
which only handled ZITADEL errors and downgraded raw gRPC statuses to
`codes.Unknown`.

Through grpc-gateway that caused `/auth/v1/users/me` to return HTTP 500
instead of HTTP 401.

So this change preserves native gRPC status errors in
`ZITADELToGRPCError`, keeps `ExtractZITADELError` aligned with those
transport codes for activity reporting, and adds regression coverage for
the converter, middleware, and gateway HTTP behavior.

---------

Co-authored-by: Gayathri Vijayan <[email protected]>

internal/api/grpc/server/gateway_test.go

@@ -0,0 +1,24 @@
+package server
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/grpc-ecosystem/grpc-gateway/v2/runtime"
+	"github.com/stretchr/testify/assert"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+)
+
+func TestErrorHandler_PreservesUnauthenticatedStatus(t *testing.T) {
+	req := httptest.NewRequest(http.MethodGet, "/auth/v1/users/me", nil)
+	resp := httptest.NewRecorder()
+
+	errorHandler(context.Background(), runtime.NewServeMux(), jsonMarshaler, resp, req, status.Error(codes.Unauthenticated, "auth header missing"))
+
+	assert.Equal(t, http.StatusUnauthorized, resp.Code)
+	assert.Contains(t, resp.Body.String(), `"code":16`)
+	assert.Contains(t, resp.Body.String(), `"message":"auth header missing"`)
+}

internal/api/grpc/server/middleware/error_interceptor_test.go

@@ -43,6 +43,18 @@ func Test_toGRPCError(t *testing.T) {
 			want:     nil,
 			wantCode: codes.FailedPrecondition,
 		},
+		{
+			name: "grpc status error",
+			args: args{
+				ctx: context.Background(),
+				req: &mockReq{},
+				handler: func(context.Context, any) (any, error) {
+					return nil, status.Error(codes.Unauthenticated, "auth header missing")
+				},
+			},
+			want:     nil,
+			wantCode: codes.Unauthenticated,
+		},
 		{
 			name: "panic with string",
 			args: args{