A bearer 401 from the dashboard gate was returned to the client but never written to dashboard-auth.log. Record session_rejected with the client-facing reason, path, and IP, and never the bearer. When that rejection is the app's saved bearer, the desktop mint error says the app token is invalid instead of telling the user to re-authenticate the server OAuth session. Fixes #103117