Distinguish expired magic links from invalid tokens

When a magic link token expires, the user now sees a specific
error message ("This magic link has expired. Please request a
new one.") instead of the generic "Failed to connect" error.

This adds ErrExpiredToken to the IAM error types, checks for
statelesstoken.ErrExpiredToken in both GetMagicLinkEmail and
OpenSessionWithMagicLink, and handles it in the trust resolver
and frontend.

Signed-off-by: Bryan Frimin <bryan@getprobo.com>

pkg/iam/auth_service.go

@@ -634,6 +634,11 @@ func (s AuthService) SendMagicLink(ctx context.Context, req *SendMagicLinkReques
 func (s AuthService) GetMagicLinkEmail(ctx context.Context, tokenString string) (mail.Addr, error) {
 	payload, err := statelesstoken.ValidateToken[MagicLinkData](s.tokenSecret, TokenTypeMagicLink, tokenString)
 	if err != nil {
+		var errExpired *statelesstoken.ErrExpiredToken
+		if errors.As(err, &errExpired) {
+			return mail.Nil, NewExpiredTokenError()
+		}
+
 		return mail.Nil, NewInvalidTokenError()
 	}
 
@@ -649,6 +654,11 @@ func (s AuthService) OpenSessionWithMagicLink(ctx context.Context, tokenString s
 
 	payload, err := statelesstoken.ValidateToken[MagicLinkData](s.tokenSecret, TokenTypeMagicLink, tokenString)
 	if err != nil {
+		var errExpired *statelesstoken.ErrExpiredToken
+		if errors.As(err, &errExpired) {
+			return nil, nil, nil, NewExpiredTokenError()
+		}
+
 		return nil, nil, nil, NewInvalidTokenError()
 	}