[binarydev]

Fixes #295

Summary

• Handle HTTP 400 on /u/login/password without data-error-code: When Auth0 rejects a password submission without rendering a field-level data-error-code attribute (e.g., accounts that have not yet reset their password / accepted updated terms following Generac's April 2026 security migration, or custom DB script rejections that render a #prompt-alert banner), _post_login_form now extracts the human-readable alert text from #prompt-alert / .ulp-input-error-message / .ulp-validator-error and raises InvalidCredentialsError instead of falling through to an uncaught RuntimeError with <!DOCTYPE html> in the log.
• Recognize invalid-email-format and rate-limit error codes as credential errors: Added "email", "many-attempts", and "many_attempts" to _CREDENTIAL_ERROR_KEYWORDS.
• Strip surrounding whitespace from email input: Normalizes the email address with .strip() in config_flow.py and auth.py so copy-paste whitespace doesn't trigger invalid-email-format on /u/login/identifier or cause a mismatch between the trimmed session username and the /u/login/password form submission.
• Actionable error message: Updated the auth error string in translations/en.json to remind users who haven't reset their password since the April 2026 security update to sign in at app.mobilelinkgen.com first.