fix: the classifier does not survive structuredClone, and the test now proves it

Since round 1 the doc claimed the `name` fallback covers "a structured clone or
a JSON hop". Verified, and it is false for half of that:

  structuredClone(new InsecureTokenEndpointError(url))
    -> name: "Error", tokenEndpoint: undefined, constructor: Error

structuredClone normalizes a custom Error subclass back to Error, so neither
arm has anything left to match. A caller routing this error through
structuredClone or postMessage would silently get the generic retryable
handling back — the exact defect this PR removes.

The test could not have caught it: it hand-built a look-alike plain object, so
it asserted what I believed the boundary does rather than what it does. It now
performs a real JSON round trip (asserting the prototype is gone), and a second
case pins that structuredClone is NOT recognized — turning a false claim into a
tested limitation.

The doc comment now scopes the contract to JSON and states the structuredClone
limit with the remedy: serialize the fields explicitly across such a boundary.

Also removes an orphaned JSDoc block the round-4 refactor stranded above the
report helper, and gives showInsecureTokenEndpointNotice its own doc back.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018MvNbmAtQuWhDvzi4yXDju
Signed-off-by: cliffhall <cliff@futurescale.com>

clients/web/src/lib/insecureTokenEndpointNotice.ts

@@ -31,12 +31,6 @@ import {
   insecureTokenEndpointTitle,
 } from "../utils/oauthUx";
 
-/**
- * Show the terminal notice when `err` is the SDK's `InsecureTokenEndpointError`.
- *
- * @returns `true` when it was handled (the caller should stop), `false` when
- * `err` is some other failure and the caller's normal handling applies.
- */
 /**
  * Report the refusal **and** clear the re-auth banner for that server.
  *
@@ -79,6 +73,16 @@ export function reportTerminalInsecureTokenEndpoint<
   return true;
 }
 
+/**
+ * Show the notice alone, without touching the banner.
+ *
+ * Prefer {@link reportTerminalInsecureTokenEndpoint} — the two are one
+ * invariant. This stays exported for the one arm that has already cleared the
+ * banner itself before starting.
+ *
+ * @returns `true` when it was handled (the caller should stop), `false` when
+ * `err` is some other failure and the caller's normal handling applies.
+ */
 export function showInsecureTokenEndpointNotice(
   err: unknown,
   serverName?: string,