Keep API not-found and 401 responses usable behind Ingress and in the Web UI.

Return native JSON with the missing id in the message, clear stale sessions on
401, and document ingress-nginx annotations so branded HTML 404/405 pages do
not rewrite simulator bodies.

app/vsphere/inventory.py

@@ -60,6 +60,36 @@ async def get_object(database: Database, moid: str) -> ManagedObject | None:
     return None if row is None else _row(row)
 
 
+_TYPE_RESOURCE: dict[str, str] = {
+    "HostSystem": "host",
+    "VirtualMachine": "vm",
+    "Datastore": "datastore",
+    "Datacenter": "datacenter",
+    "Folder": "folder",
+    "ClusterComputeResource": "cluster",
+    "ResourcePool": "resource_pool",
+    "Network": "network",
+}
+
+
+async def require_object(
+    database: Database,
+    moid: str,
+    *,
+    type_name: str | None = None,
+    resource: str | None = None,
+) -> ManagedObject:
+    """Return the managed object or raise a native not-found with the bad id."""
+
+    from app.vsphere.errors import no_such
+
+    obj = await get_object(database, moid)
+    label = resource or (type_name and _TYPE_RESOURCE.get(type_name)) or "object"
+    if obj is None or (type_name is not None and obj.type != type_name):
+        raise no_such(label, moid)
+    return obj
+
+
 async def upsert_object(
     database: Database,
     *,