fix: clarify New-API authentication failures

backend/test_upstream_token_refresh.py

@@ -8,7 +8,7 @@ import httpx
 import pytest
 
 from app.services import upstream_client
-from app.services.upstream_client import UpstreamClient
+from app.services.upstream_client import UpstreamClient, UpstreamError
 
 
 class FakeHttpClient:
@@ -412,3 +412,41 @@ def test_login_password_empty_prefix_defaults_to_user_api_login(monkeypatch):
     assert headers["Authorization"] == "Bearer nox-access"
     assert headers["Nox-Api-User"] == "9"
     assert headers["New-Api-User"] == "9"
+
+
+def test_login_password_surfaces_business_error_response(monkeypatch):
+    def handler(request: httpx.Request, kwargs):
+        return _response(request, 200, {
+            "success": False,
+            "message": "用户名或密码错误",
+        })
+
+    _install_fake_client(monkeypatch, handler)
+    client = UpstreamClient(
+        base_url="http://newapi.local",
+        api_prefix="",
+        auth_type="login_password",
+        auth_config={"email": "admin", "password": "wrong"},
+    )
+
+    with pytest.raises(UpstreamError, match="用户名或密码错误"):
+        client.login()
+
+
+def test_login_password_reports_unsupported_two_factor(monkeypatch):
+    def handler(request: httpx.Request, kwargs):
+        return _response(request, 200, {
+            "success": True,
+            "data": {"require_2fa": True, "flow_token": "flow"},
+        })
+
+    _install_fake_client(monkeypatch, handler)
+    client = UpstreamClient(
+        base_url="http://newapi.local",
+        api_prefix="",
+        auth_type="login_password",
+        auth_config={"email": "admin", "password": "secret"},
+    )
+
+    with pytest.raises(UpstreamError, match="二次验证"):
+        client.login()