Client authentication wrapped every Storage error in a new invalid_client
or unauthorized_client error. RequestError maps the HTTP status from the
outermost oidc.Error, so a server_error that the Storage returned for a
database fault reached the client as 401 invalid_client instead of 500
server_error.

I added clientAuthError in pkg/op/client.go. It returns the Storage's own
oidc.Error when its type is server_error and wraps every other error in the
given base error as before.

The 8 client authentication wrap sites use it,
in client.go, server_legacy.go (2), token_client_credentials.go,
token_code.go, token_exchange.go, token_request.go and token_revocation.go.
Other typed Storage errors keep the invalid_client answer, so a Storage
cannot leak client existence through a different error type. No exported
signature changes.

pkg/op/client_auth_error_test.go covers AuthorizeClientCredentialsClient,
AuthorizeClientIDSecret and a POST to the token endpoint of
op.NewOpenIDProvider with basic auth for the client_credentials and
authorization_code grants. A plain Storage error (wrong secret) still
answers 401 invalid_client.

Fixes zitadel#990

Commands I ran with go1.26.4 darwin/arm64.

Main c9e2385 plus the new test file

    $ go test -count=1 -run 'StorageErrors' -v ./pkg/op/
    --- FAIL: TestAuthorizeClientCredentialsClient_StorageErrors/typed_server_error_passes_through
        expected: "server_error"
        actual  : "invalid_client"
    --- FAIL: TestAuthorizeClientIDSecret_StorageErrors/typed_server_error_passes_through
        expected: "server_error"
        actual  : "invalid_client"
    --- FAIL: TestTokenEndpoint_ClientAuthStorageErrors/client_credentials/typed_server_error_passes_through
        expected: 500
        actual  : 401
    --- FAIL: TestTokenEndpoint_ClientAuthStorageErrors/authorization_code/typed_server_error_passes_through
        expected: 500
        actual  : 401
    (the 4 plain_error_stays_invalid_client subtests PASS)
    FAIL	github.com/zitadel/oidc/v3/pkg/op	1.416s

This branch

    $ go test -count=1 -run 'StorageErrors' -v ./pkg/op/
    (all 8 subtests PASS)
    ok  	github.com/zitadel/oidc/v3/pkg/op	0.986s

    $ go test -race -count=1 ./pkg/...
    ok  	github.com/zitadel/oidc/v3/pkg/client	3.872s
    ok  	github.com/zitadel/oidc/v3/pkg/client/rp	3.915s
    ok  	github.com/zitadel/oidc/v3/pkg/client/rp/cli	1.595s
    ok  	github.com/zitadel/oidc/v3/pkg/client/rs	5.606s
    ok  	github.com/zitadel/oidc/v3/pkg/crypto	2.753s
    ok  	github.com/zitadel/oidc/v3/pkg/http	4.408s
    ok  	github.com/zitadel/oidc/v3/pkg/oidc	4.009s
    ok  	github.com/zitadel/oidc/v3/pkg/op	10.268s
    ok  	github.com/zitadel/oidc/v3/pkg/strings	4.149s
    (main c9e2385 gives the same 9 ok lines)

    $ gofmt -l pkg/op
    (no output)
    $ go vet ./pkg/op/
    (no output)
    $ staticcheck -tags '' ./...                       (2026.2.1)
    $ staticcheck -tags no_otel ./...
    $ staticcheck -tags create_regression_data ./...
    (no findings for all three)

End to end over real HTTP (httptest.NewServer, op.NewProvider with the
example storage, Storage returns oidc.ErrServerError() from
AuthorizeClientIDSecret and ClientCredentials)

    POST /oauth/token grant_type=client_credentials, basic auth
    main         401 {"error":"invalid_client"}
    this branch  500 {"error":"server_error"}

The same Storage fault on authorization_code, revocation and device
authorization goes from 401 or 400 on main to 500 server_error on this
branch, through op.NewProvider and through op.RegisterLegacyServer. Legacy
server introspection goes from 400 unauthorized_client to 500 server_error.
The op.Provider introspection handler writes 401 for every error and stays
as it is. A plain Storage error gives the same response on main and on this
branch in every case.

Not run here are CodeQL and the Go 1.27 CI job.

clientAuthError returned the *oidc.Error that errors.As matched inside
the Storage error. That dropped an outer StatusError, so a 503 from
op.NewStatusError became 500 on the LegacyServer token, revocation and
introspection endpoints. It also handed the Storage's returnParent flag
to MarshalJSON, which panics on a nil parent, and it cut the rest of the
error chain.

The helper now returns oidc.ErrServerError().WithParent(err), so the
whole Storage error stays the parent. It checks for a typed nil
*oidc.Error before reading ErrorType. ClientJWTAuth uses the helper too.

The Storage docs of GetClientByClientID, AuthorizeClientIDSecret and
ClientCredentials now say when to return oidc.ErrServerError().

TestClientAuthStorageErrors sends token, revocation and introspection
requests to the Provider and to the LegacyServer through authorizePaths,
and fails each client authentication lookup with a server_error, a
server_error with a nil parent returned to the client, a server_error in
a 503 StatusError, a plain error and a typed client error. Each of the 9
call sites has a failing row. TestClientBasicAuth and TestClientJWTAuth
gain server_error, error chain, typed client error and typed nil rows,
asserted with ErrorAs and the error type. The test generates the RSA key
once.