auth: split JWT validation errors by failure cause

get_token_data used to raise the same "Could not validate credentials"
for every JWT-level failure (bad signature, expired, malformed), which
made console WebSocket auth failures impossible to tell apart. Return a
distinct detail per cause and log the underlying exception plus the
unverified header alg value on rejection.

tests/api/routes/test_routes.py

@@ -106,7 +106,7 @@ class TestRoutes:
                     async with aconnect_ws(path, client, params=params) as ws:
                         json_notification = await ws.receive_json()
                         assert json_notification['event'] == {
-                            'message': 'Could not authenticate while connecting to controller WebSocket: Could not validate credentials'
+                            'message': 'Could not authenticate while connecting to controller WebSocket: Invalid token (DecodeError)'
                         }