[Bug] Preserve authentication and transport errors in CLI diagnostics

[data-angel]

Part of #9.

Problem

CLI gateway requests currently collapse non-success responses and transport exceptions into a null result. Commands can therefore report that the gateway is unreachable when it is actually reachable but rejected an unauthenticated or unauthorized admin request.

This makes cluster diagnosis misleading and encourages unnecessary service restarts.

Desired contract

• Preserve HTTP status, structured LLooM error code, and safe transport failure details.
• Distinguish at least authentication failure, authorization failure, connection refusal, timeout, and server error.
• Support an explicit environment-backed admin credential path for service-managed installations without printing secret material.
• Keep human-readable output actionable and --json output stable for automation.

Acceptance criteria

• A reachable gateway returning 401 is reported as missing/invalid authentication, not unreachable.
• A 403 is distinguished from a 401.
• Connection refusal and timeout remain distinct.
• No credential value appears in logs, errors, process arguments, or receipts.
• Cluster status, doctor, runtime, and deployment commands share the same error semantics.

Non-goals

• Weakening remote admin authorization.
• Treating missing credentials as permission to retry without authentication.