Function classify_access_check 

fn classify_access_check(status: u16) -> AccessCheck

Classifies a wolf-server access_check status.

The split matters: a 502 from a wolf-server behind a dead proxy, or a 404 from a mistyped server URL, is not “this token may not pass” — reporting it as a 401 hides a broken deployment behind a plausible denial.