Fix dashboard JWT telemetry classification - #216

Summary

• Classifies invalid Dashboard JWTs as client authentication warnings while reserving system errors for JWKS dependency failures.
• Adds internal-only exception telemetry context and category overrides so system-category 401s stay client-compatible but emit exception.system records.
• Updates Logfire exception downgrading to use the effective exception category, and adds local-JWKS contract coverage for token/JWKS failure modes.

No public HTTP, JSON, SDK, database, deployment, or migration contract changes are intended.

Verification

• uv run --project apps/api pytest apps/api/tests/contract/test_dashboard_jwt_authentication_contract.py -q -> 13 passed
• uv run --project apps/api pytest apps/api/tests/contract -q -> 208 passed, 15 warnings
• make check -> Ruff passed, Pyright 0 errors
• git diff --cached --check before commit -> clean

No manual API, worker, or local-dev checks were performed beyond the contract and check suites above.

Deployment Notes

• No new or changed environment variables.
• No database migrations, queue changes, storage changes, or release-order requirements.
• Rollback reverts telemetry classification only; client-visible authentication responses remain unchanged by this PR.

Checklist

• Tests were added or updated when behavior changed
• Public docs, examples, or OpenAPI contracts were updated when needed (not needed: no public contract change)
• Database migrations are idempotent and safe to deploy (not applicable: no migrations)
• Logs, errors, and validation paths avoid leaking secrets or user data
• The pull request description explains any breaking or user-visible change (none intended)