test(e2e): report what the gateway refused

[arloliu]

What a console failure could not say

A console scenario that fails on a control it cannot find has usually left the
console for the login. The page goes there because request()
(internal/ui/static/app.js:401) got a 401 and called signIn(), which sets
phase to navigating and empties .panels.

Which fetch was refused, and why, decided nothing the scenario could show.
The merged chooseOption change names where the page went; this names why
it went there.

The counter already existed

profgate_auth_failures_total{mode,reason}
(internal/metrics/prometheus.go:103) counts every request the auth layer
refused. The reason vocabulary is auth.Reasons() (internal/auth/auth.go:76),
so session (the cookie would not open or had expired), csrf
(Sec-Fetch-Site), and the callback reasons are told apart at the point of
failure.

No test read it before this.

The change

Both console scenarios forward the ops port and log every non-zero counter —
only when the scenario failed. A passing run logs nothing and its output is
unchanged.

The port-forward is registered for cleanup before the scrape is, so the scrape
runs first and still has a forward. h.forward binds its lifetime to stopCh
rather than to the caller's context, so it survives into cleanup; the scrape
carries a context of its own because the test's is cancelled by then.

The baseline this establishes

Three passing runs, scraped before and after the second load:

before the second load    profgate_auth_failures_total{mode="oidc",reason="missing"} 1
after choosing a profile  profgate_auth_failures_total{mode="oidc",reason="missing"} 1

One refusal, reason missing, counted during the first load — which
carries no session and is meant to be refused. The count across the second
load is zero. So an extra refusal there is the anomaly, and its reason is the
answer to why console-oidc fails on the lane.

Proof

case	outcome
scenario navigates to the login before choosing	FAIL, and the counter is logged
unmodified	both console scenarios PASS, nothing logged

The full suite on the current lane logged no counter at all across every
scenario.

Validation

mise run lint (0 issues), mise run test, mise run check, and semlf --base origin/main pass. mise run test:e2e ran green on the current lane
in 696.9s.