fix: invalid-credentials code, no refresh on wrong pw

crates/application/src/users/request_account_deletion.rs

@@ -30,7 +30,7 @@ pub async fn execute(
         .verify(password, actor_user.password_hash())
         .await?
     {
-        return Err(DomainError::Unauthorized("incorrect password".into()));
+        return Err(DomainError::InvalidCredentials("incorrect password".into()));
     }
 
     let target_user = if is_self {

crates/application/tests/users/request_account_deletion_test.rs

@@ -138,7 +138,10 @@ async fn a_wrong_password_is_unauthorized_and_changes_nothing() {
         .await
         .unwrap_err();
 
-    assert!(matches!(err, DomainError::Unauthorized(_)), "got {err:?}");
+    assert!(
+        matches!(err, DomainError::InvalidCredentials(_)),
+        "got {err:?}"
+    );
     assert!(f.is_live(&alice).await);
     assert!(f.store.recorded_events().is_empty());
 }
@@ -166,7 +169,10 @@ async fn an_admin_deletes_another_user_with_their_own_password() {
     let err = request_account_deletion::execute(&f.deps, admin.clone(), bob.clone(), "bobs-pw")
         .await
         .unwrap_err();
-    assert!(matches!(err, DomainError::Unauthorized(_)), "got {err:?}");
+    assert!(
+        matches!(err, DomainError::InvalidCredentials(_)),
+        "got {err:?}"
+    );
     assert!(f.is_live(&bob).await);
 
     request_account_deletion::execute(&f.deps, admin.clone(), bob.clone(), PASSWORD)