Keep API not-found and 401 responses usable behind Ingress and in the Web UI.

Return native JSON with the missing id in the message, clear stale sessions on
401, and document ingress-nginx annotations so branded HTML 404/405 pages do
not rewrite simulator bodies.

tests/unit/test_vsphere_errors.py

@@ -0,0 +1,22 @@
+"""vSphere not-found helpers expose the missing id in the message."""
+
+from __future__ import annotations
+
+from app.vsphere.errors import no_such, not_found
+
+
+def test_no_such_includes_resource_id() -> None:
+    error = no_such("host", "host-999")
+    assert error.status_code == 404
+    detail = error.detail
+    assert isinstance(detail, dict)
+    assert detail["error_type"] == "not_found"
+    message = detail["messages"][0]
+    assert message["default_message"] == "No such host ('host-999')"
+    assert message["args"] == ["host-999"]
+    assert detail["data"]["host"] == "No such host ('host-999')"
+
+
+def test_not_found_accepts_args() -> None:
+    error = not_found("Guest file not found: /tmp/x", args=["/tmp/x"])
+    assert error.detail["messages"][0]["args"] == ["/tmp/x"]