Keep API not-found and 401 responses usable behind Ingress and in the Web UI.

Return native JSON with the missing id in the message, clear stale sessions on
401, and document ingress-nginx annotations so branded HTML 404/405 pages do
not rewrite simulator bodies.

app/vsphere/errors.py

@@ -41,16 +41,38 @@ def unauthenticated(message: str = "Authentication required") -> VsphereError:
     )
 
 
-def not_found(message: str = "Not found") -> VsphereError:
+def not_found(message: str = "Not found", *, args: list[Any] | None = None) -> VsphereError:
     return VsphereError(
         404,
         error_type="not_found",
         messages=[
-            {"default_message": message, "id": "com.vmware.vapi.std.errors.not_found", "args": []}
+            {
+                "default_message": message,
+                "id": "com.vmware.vapi.std.errors.not_found",
+                "args": list(args or []),
+            }
         ],
     )
 
 
+def no_such(resource: str, resource_id: str) -> VsphereError:
+    """Native not-found with the missing id in the message (Ingress-friendly JSON)."""
+
+    message = f"No such {resource} ('{resource_id}')"
+    return VsphereError(
+        404,
+        error_type="not_found",
+        messages=[
+            {
+                "default_message": message,
+                "id": "com.vmware.vapi.std.errors.not_found",
+                "args": [resource_id],
+            }
+        ],
+        data={resource: message},
+    )
+
+
 def already_exists(message: str = "Already exists") -> VsphereError:
     return VsphereError(
         400,