fix: address verified review findings (cli-core-1)

Signed-off-by: bircni <bircni@icloud.com>

internal/app/auth.go

@@ -10,6 +10,7 @@ import (
 	"fmt"
 	"io"
 	"maps"
+	"net/http"
 	"os"
 	"path/filepath"
 	"slices"
@@ -22,6 +23,7 @@ import (
 	"gitea.dev/tea/internal/services"
 	"gitea.dev/tea/internal/settings"
 	"gitea.dev/tea/internal/terminal"
+	"gitea.dev/tea/internal/transport"
 	"github.com/spf13/cobra"
 )
 
@@ -267,7 +269,7 @@ $ tea auth login --host gitea.com --oauth --scopes read:repository,read:user`,
 			}
 			user, err := services.CurrentAccount(cmd.Context(), a.deps.Client(instance, credential.AccessToken, insecure))
 			if err != nil {
-				return err
+				return rejectedLogin(err, "the token", "check it or create a new one under Settings > Applications")
 			}
 			if selectedUser, _ := a.selectedUser(); !services.MatchAccount(selectedUser, user) {
 				return clierr.Wrap(clierr.Usage, errors.New("token account does not match --user or TEA_USER"))
@@ -304,6 +306,15 @@ $ tea auth login --host gitea.com --oauth --scopes read:repository,read:user`,
 	return login
 }
 
+// rejectedLogin words a 401 for the credential that tea auth login was given, so that Explain does
+// not blame GITEA_TOKEN or tell the user to run the command they are running.
+func rejectedLogin(err error, credential, advice string) error {
+	if apiErr, ok := errors.AsType[*transport.APIError](err); ok && apiErr.Status == http.StatusUnauthorized {
+		return explain(err, "%s was rejected by %s; %s", credential, cmp.Or(apiErr.Instance, "the instance"), advice)
+	}
+	return err
+}
+
 // confirmReplace asks before a login replaces the stored credential of an account that tea already
 // has, and reports whether it does.
 func (a *application) confirmReplace(cmd *cobra.Command, instance, user string) (bool, error) {
@@ -346,7 +357,7 @@ func (a *application) signedLogin(cmd *cobra.Command, snapshot settings.Snapshot
 	client.Signer = signer
 	user, err := services.CurrentAccount(cmd.Context(), client)
 	if err != nil {
-		return account, "", err
+		return account, "", rejectedLogin(err, "the SSH signature", "check that the key is registered for your account")
 	}
 	if selectedUser, _ := a.selectedUser(); !services.MatchAccount(selectedUser, user) {
 		return account, "", clierr.Wrap(clierr.Usage, errors.New("authenticated account does not match --user or TEA_USER"))