fix: a wrong password no longer costs an entire reinstall

The endpoint credentials are asked for at the very end of a run, after every
package is installed -- correct, because a password typed at picker time would
sit in memory through ten minutes of downloads. But any non-200 was fatal, so
one mistyped character meant repeating the whole install to get back to a
three-line prompt.

Now it retries, up to five attempts. URL and username persist across them and
blank keeps them, shown as `Bootstrap URL [https://...]:`, so only the password
is retyped -- retyping an address that was already pasted correctly is its own
source of error. `q` at the URL prompt leaves the machine public-only.

The message also names the fault. Every failure used to print "endpoint refused
the credentials", including a 404 and an unreachable host -- which is precisely
how a URL-shape bug reads as a password problem. The status is now captured
alongside the body rather than relying on --fail:

  401  wrong username or password
  404  reached the host, but no bootstrap.env is there -- check the route
  000  could not reach that address (DNS, TLS, or the host is down)

The body is used only when the code is 200, so an error page is still never
parsed as a blob; that was --fail's job and an explicit check is stronger.

`dotup private` already re-ran only this step, leaving installed packages
alone -- it was simply missing from --help, so the cheap way back in was
undiscoverable. Documented, and the failure path now points at it.

The end-to-end sends a wrong password first on purpose and asserts both the
message and that blank-blank-correct works, which is the only way to test a
recovery path. Note that harness clones the PUBLISHED repo, so it validates
what a user gets, not the working tree -- these invariants are covered in the
unit suite, which reads the tree directly. 105 -> 113.

.tests/e2e-private-tier.sh

@@ -92,12 +92,30 @@ proc wait_for {pat what} {
 	}
 }
 
-# dotup's own three: plain `read`, no TUI, so the text is the whole signal
+# dotup's own three: plain `read`, no TUI, so the text is the whole signal.
+#
+# The FIRST password sent here is deliberately wrong. These credentials are
+# asked for at the very end of a run, so a typo used to be fatal -- one wrong
+# character and the whole install had to be repeated to get back to this
+# prompt. Getting it wrong on purpose is the only way to prove the retry loop
+# exists and that the URL and username survive the attempt.
 wait_for {Bootstrap URL:} "the bootstrap URL prompt"
 send -- "$env(BOOT_URL)\r"
 wait_for {Username:}      "the username prompt"
 send -- "$env(BOOT_USER)\r"
 wait_for {Password:}      "the password prompt"
+send -- "definitely-not-the-password\r"
+
+# The message must name the actual fault. "endpoint refused the credentials"
+# was once emitted for a 401, a 404 and an unreachable host alike.
+wait_for {wrong username or password} "the wrong-password message"
+# Blank keeps the URL and the username, so only the password is retyped. The
+# bracketed default in the prompt is what proves they were retained.
+wait_for {Bootstrap URL \[} "the retry prompt, with the URL kept"
+send -- "\r"
+wait_for {Username \[}      "the retry username prompt, with the user kept"
+send -- "\r"
+wait_for {Password:}        "the retry password prompt"
 send -- "$env(BOOT_PW)\r"
 # The private repo's seven, each answered only once its TUI is genuinely ready
 # to read.

.tests/test.sh

@@ -191,6 +191,29 @@ is "PRIV_CFG is not the default config path" "0" \
 is "the private source is locked down after clone" "1" \
    "$(grep -c 'chmod -R go-rwx "\$PRIV_SRC"' $D)"
 
+printf '\n\033[1ma wrong password is not a reinstall\033[0m\n'
+# The endpoint credentials are asked for at the very END of a run, after every
+# package is installed. Any non-200 used to be fatal, so one mistyped character
+# meant repeating the whole install to get back to the prompt.
+is "the prompt retries instead of returning" "0" \
+   "$(grep -c 'endpoint refused the credentials' $D)"
+is "…up to a bounded number of attempts" "1" \
+   "$(grep -c '"$p_try" -gt 5' $D)"
+is "…and points at the cheap way back in" "1" \
+   "$(grep -c 'Re-run only this step: dotup private' $D)"
+# One message for 401, 404 and an unreachable host is how a URL-shape bug spends
+# an evening looking like a password problem. Each needs a different next move.
+is "a 401 names the password"        "1" "$(grep -c 'wrong username or password' $D)"
+is "a 404 names the route"           "1" "$(grep -c 'no bootstrap.env is there' $D)"
+is "an unreachable host says so"     "1" "$(grep -c 'could not reach that address' $D)"
+# --fail is gone, so the code must be checked explicitly or an error page would
+# be parsed as the credential blob.
+is "the blob is used only on 200"    "1" "$(grep -cF '200) break ;;' $D)"
+# The subcommand existed but was absent from --help, so there was no way to
+# discover the recovery path.
+is "dotup private is documented"     "1" \
+   "$(sh $D --help 2>&1 | grep -c 'ONLY the private tier')"
+
 printf '\n\033[1mrisk model — the invariants that matter\033[0m\n'
 reset
 is "defaults tick nothing invasive"   "" "$(picked invasive)"