fix: invalid-credentials code, no refresh on wrong pw

crates/application/tests/users/request_account_deletion_test.rs

@@ -138,7 +138,10 @@ async fn a_wrong_password_is_unauthorized_and_changes_nothing() {
         .await
         .unwrap_err();
 
-    assert!(matches!(err, DomainError::Unauthorized(_)), "got {err:?}");
+    assert!(
+        matches!(err, DomainError::InvalidCredentials(_)),
+        "got {err:?}"
+    );
     assert!(f.is_live(&alice).await);
     assert!(f.store.recorded_events().is_empty());
 }
@@ -166,7 +169,10 @@ async fn an_admin_deletes_another_user_with_their_own_password() {
     let err = request_account_deletion::execute(&f.deps, admin.clone(), bob.clone(), "bobs-pw")
         .await
         .unwrap_err();
-    assert!(matches!(err, DomainError::Unauthorized(_)), "got {err:?}");
+    assert!(
+        matches!(err, DomainError::InvalidCredentials(_)),
+        "got {err:?}"
+    );
     assert!(f.is_live(&bob).await);
 
     request_account_deletion::execute(&f.deps, admin.clone(), bob.clone(), PASSWORD)