Fix auth-error classification and update token extraction docs

[martparve]

Problem

Two issues, found while setting the plugin up against a live account:

1. Misleading error on a bad/expired token. Plaud rejects a wrong token with HTTP 200 and an in-body status code, e.g. {"status":-3900,"msg":"invalid auth header"}. The client mapped any non-success in-body status to invalid_response -> user-facing "unexpected API response format. Retry and inspect logs if it persists." Retrying never helps, and the real cause (wrong/expired token) is hidden. This sent me down a long debugging path before I realized it was just auth.

2. Obsolete token instructions. localStorage.getItem("tokenstr") no longer exists in the Plaud web app. Worse, localStorage now contains a pld_<id>:frillSsoToken JWT whose payload is only {email,id,name} -- that's the Frill feedback-widget SSO token, not the API token, and pasting it produces exactly the -3900 "invalid auth header" rejection above. The real credential is the Bearer access token (client_id:"web" in its payload) sent on every API request.

Changes

• src/plaud-api.ts: new isAuthFailureEnvelope() -- non-success in-body status that looks auth-related (status:-3900, or a msg matching auth/token/unauthorized/forbidden/login) now throws category auth instead of invalid_response.
• src/main.ts: the auth message now tells the user the token is invalid/expired and to extract a fresh one.
• test/plaud-api-client.test.mjs: regression test asserting the HTTP 200 / status:-3900 envelope maps to auth. Full suite passes (56 tests).
• README.md: replaced the dead tokenstr steps with the Network-tab method (plus a fetch/XHR console hook), and a warning about the frillSsoToken trap. Also notes the access token is short-lived (~24h).

Notes

The API client itself (/file/simple/web, Bearer auth, data_file_list parsing) was already correct against the live API -- no transport changes needed.

🤖 Generated with Claude Code