Stop reporting a failed login lookup as "Invalid Email"

GetUserByAuthname / GetUserByContactNo / GetUserLogin discarded the
Scan error, so a database that could not answer — down, pool exhausted,
or booted without its config (2026-07-20) — came back as uid 0 and every
user was told their email was wrong.

One lookup, GetUserLogin, now returns an error; sql.ErrNoRows is "not
found" and anything else reaches the service, which answers 500 "Login
is temporarily unavailable" and logs the cause. 409 "Invalid Email" is
unchanged for a genuine no-match: the console reads that exact shape as
"not registered". NULL password/role columns scan through sql.Null* so
they do not become 500s.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

scratch/posseparation/main.go

@@ -137,15 +137,11 @@ func main() {
 	}
 
 	fmt.Println("\n3. a till account cannot reach the Nearle Daily application")
-	uid, _, _ := users.GetUserByAuthname(sup.Authname, sup.Configid)
-	check("applogin lookup does not find the supervisor",
-		uid == 0,
-		fmt.Sprintf("GetUserByAuthname(%s) -> userid %d", sup.Authname, uid))
-
-	uid2, _, _, _ := users.GetUserLogin("authname", sup.Authname, sup.Configid)
-	check("tenant web login does not find the supervisor",
-		uid2 == 0,
-		fmt.Sprintf("GetUserLogin(%s) -> userid %d", sup.Authname, uid2))
+	// Both the app and the console sign-in now go through GetUserLogin.
+	uid2, _, _, _, lookupErr := users.GetUserLogin("authname", sup.Authname, sup.Configid)
+	check("app and tenant web login do not find the supervisor",
+		uid2 == 0 && lookupErr == nil,
+		fmt.Sprintf("GetUserLogin(%s) -> userid %d err=%v", sup.Authname, uid2, lookupErr))
 
 	uid3, _ := users.FindUserID(sup.Authname, "", sup.Configid)
 	check("password-setup lookup does not find the supervisor",