feat: enhance login error handling to differentiate between staff-only and wrong password errors

.claude/skills/qa-clinicpro/driver.mjs

@@ -113,8 +113,12 @@ async function login(role) {
   const j = await r.json();
   if (j.access_token) return j;
 
-  // ERR_AUTH_006 here means "staff-only endpoint", not "wrong password".
-  if (j?.errors?.some((e) => e.code === 'ERR_AUTH_006')) {
+  // ERR_AUTH_006 means "staff-only endpoint", not "wrong password".
+  // ERR_AUTH_005 IS "wrong password" — expected whenever the local DB was
+  // replaced by a production dump, which brings its own hashes and drops the
+  // QA accounts' passwords. OTP still authenticates those users, so fall
+  // through to it rather than failing the whole run.
+  if (j?.errors?.some((e) => e.code === 'ERR_AUTH_006' || e.code === 'ERR_AUTH_005')) {
     const o = await otpLogin(mobile_number).catch((e) => ({ _err: e.message }));
     if (o.access_token) return o;
     // send-code is capped at 5/hour/IP; once burned, mint the JWT with the app's