Keep API not-found and 401 responses usable behind Ingress and in the Web UI.

Return native JSON with the missing id in the message, clear stale sessions on
401, and document ingress-nginx annotations so branded HTML 404/405 pages do
not rewrite simulator bodies.

app/vsphere/domain/inventory_ops.py

@@ -218,9 +218,7 @@ def _is_seed_host_or_named_vm(moid: str, obj: Any) -> bool:
 
 
 async def set_host_maintenance(database: Database, host: str, enabled: bool) -> dict[str, Any]:
-    obj = await inventory.get_object(database, host)
-    if obj is None or obj.type != "HostSystem":
-        raise not_found(f"Host {host} not found")
+    obj = await inventory.require_object(database, host, type_name="HostSystem", resource="host")
     props = dict(obj.props)
     props["connection_state"] = "CONNECTED"
     props["maintenance_mode"] = enabled

app/vsphere/domain/vm_ops.py

@@ -14,10 +14,7 @@ from app.vsphere.errors import invalid_argument, not_found
 
 
 async def require_vm(database: Database, vm: str) -> inventory.ManagedObject:
-    obj = await inventory.get_object(database, vm)
-    if obj is None or obj.type != "VirtualMachine":
-        raise not_found(f"VM {vm} not found")
-    return obj
+    return await inventory.require_object(database, vm, type_name="VirtualMachine", resource="vm")
 
 
 def _default_identity(name: str, moid: str) -> dict[str, str]: