fix(shell): auth-rejected hub no longer reported as unreachable

The sustained-failure banner treated every failed health poll as
'can't reach the hub'. With token auth active, a wrong or rotated
token gets UNAUTHENTICATED from a perfectly reachable hub — the
old wording sent the operator to fix the endpoint. The shell now
uses the SDK's probe() and, on auth rejection, switches the banner
to 'rejected the sign-in — check the access token' (key-off icon,
DE+EN). Two widget tests pin the wording per failure kind and the
banner clearing once the probe turns serving.

Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>

lib/l10n/app_localizations_de.dart

@@ -2890,6 +2890,11 @@ class AppLocalizationsDe extends AppLocalizations {
   @override
   String get hubUnreachableOpenSettings => 'Einstellungen öffnen';
 
+  @override
+  String hubAuthRejectedBanner(String endpoint) {
+    return '$endpoint lehnt die Anmeldung ab — Zugriffstoken prüfen';
+  }
+
   @override
   String get navFederation => 'Föderation';