Failed logins don't record why they failed #528

With PR #439, every failed login answers the caller with the same Login failed., so the Events log is the admin's only view of what happened. Two gaps there:

• The Login event looks the same for a wrong password, an unknown username and a locked account. @tonygermano asked on PR Stop failed logins from revealing which usernames exist #439 for a failure reason on every failed Login event (invalid credentials, account locked, and so on). The reason is known in DefaultUserController.authorizeUser, but UserServlet.login builds the event from the LoginStatus it sends back to the caller, so the reason needs a way across that doesn't reach the caller.
• HTTP basic auth on the API logs no Login event at all. 33 failed basic-auth requests and one successful one to GET /api/users/current left nothing in the Events log; the only event in that window was the User account locked event PR Stop failed logins from revealing which usernames exist #439 adds.

Co-authored with Claude Code.