match app-password errors on the typed lex error, not raw message equality

isErrorMaybeAppPasswordPermissions compared getErrorName against
'TokenInvalid', a code the PDS never sends - the string fallback was
doing all the work. The real wire shape is the GENERIC 'InvalidToken'
code (also used for malformed/expired tokens) with the app-password
specifics only in the message, so the typed path now matches code AND
message ('Bad token scope' / 'Bad token method').

Deactivated and DeactivateAccountDialog used raw switch(e.message)
equality; both now go through the helper. Tests updated to pin the
actual PDS wire shape (and reject plain malformed-token errors).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

oxlint-suppressions.json

@@ -854,9 +854,6 @@
     },
     "typescript/no-misused-promises": {
       "count": 1
-    },
-    "typescript/no-unsafe-member-access": {
-      "count": 1
     }
   },
   "src/screens/E2E/SharedPreferencesTesterScreen.tsx": {
@@ -1140,9 +1137,6 @@
     },
     "typescript/no-misused-promises": {
       "count": 1
-    },
-    "typescript/no-unsafe-member-access": {
-      "count": 1
     }
   },
   "src/screens/Settings/components/DeleteAccountDialog.tsx": {