[AdaAibaby]

Rebased follow-up to #3414, which @ryan-sana closed with: "A rebased PR on current main, with a test for the disconnect case, would be very welcome." This is that rebase, adapted to the refactored error helper and with the requested tests.

Problem

kin-openapi reads the full request body (io.ReadAll) before calling any auth function. When that read fails — the client dropped the connection, or the server read deadline fired while the goroutine was queued under high concurrency — kin-openapi returns a RequestError{Reason:"reading failed"} wrapping a net.Error, carried inside the SecurityRequirementsError (because the body is read before auth runs).

On current main that network failure flows through sharedauth.ProcessSecurityErrors and is reported as a SecurityRequirementsError:

• logged WARN,
• counted as a 400/401 auth error in metrics,
• marked as an error on the OTel span.

All three are misleading — nothing was wrong with the caller's credentials; the connection just went away.

Fix

• New clientDisconnectReason helper: a RequestError{reading failed} whose cause is a net.Error is detected in MultiErrorHandler and tagged with clientDisconnectPrefix instead of going to ProcessSecurityErrors.
• ErrorHandler recognises the prefix, records an informational span event (telemetry.ReportEvent, not an error), returns 499 Client Closed Request, and skips c.Errors — so it never looks like an auth failure in logs or metrics.
• A reading failure with a non-network cause, and genuine auth errors, are untouched.

Adapted to current main

#3414 edited processCustomErrors in error.go; that was refactored into sharedauth.ProcessSecurityErrors (commit f83a684). This PR hooks the classification into MultiErrorHandler's SecurityRequirementsError case instead, keeping the auth package unchanged.

Tests (as requested)

• TestMultiErrorHandlerClassifiesClientDisconnect — a net.Error body-read failure gets the disconnect prefix; a non-network read failure and a real missing-credential error do not.
• TestErrorHandlerClientDisconnectReturns499 — the prefix yields 499, no response body, and nothing on c.Errors.
• TestMultiToErrorHandlerClientDisconnectEndToEnd — both stages together: network failure → 499, non-network read failure → auth 401.

go test ./packages/api/internal/utils/ passes; go build ./... and go vet are clean.

Closes #3413. Supersedes #3414.