feat(web): filter by ownerId and surface missing-role 401 state

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

app/composables/useAuth.ts

@@ -1,5 +1,15 @@
 import type { ZitadelAuth } from "@kuns/zitadel-auth";
 
+/** API call failure carrying the HTTP status (401 = authenticated but not authorized). */
+export class ApiError extends Error {
+  constructor(
+    message: string,
+    public status: number,
+  ) {
+    super(message);
+  }
+}
+
 // Access the bootstrap-provided Zitadel auth instance + a small JSON helper for /api calls.
 // By the time any component mounts, the plugin has gated auth, so `auth` is authenticated.
 // `auth.fetch` auto-attaches the Bearer access token.
@@ -16,7 +26,7 @@ export function useAuth() {
       } catch {
         // non-JSON error body
       }
-      throw new Error(message);
+      throw new ApiError(message, res.status);
     }
     if (res.status === 204) return undefined as T;
     return (await res.json()) as T;