`AuthFunctions.cs`: Catch-all `Exception` in token validation masks specific auth failure reasons

### Problem

`GetAuthenticatedUserIdFromRequestAsync()` catches all exceptions from Google token validation and silently falls back to session validation:

**File:** `PluckIt.Functions/Functions/AuthFunctions.cs:260`

```csharp
catch (Exception)
{
// fall through to session validation
}
```

This means a network timeout, a malformed JWT, an expired token, and a quota error all produce the same silent fallback. If both validation paths fail, the error surfaced to the caller gives no indication of *why*.

### Impact

- Auth failures are hard to debug — logs show no detail about what went wrong
- Transient errors (e.g. Google JWKS endpoint timeout) silently degrade to session auth without alerting
- Security-relevant events (e.g. tampered tokens) are not logged

### Proposed Fix

Catch specific exception types and log each:

```csharp
catch (SecurityTokenExpiredException ex)
{
logger.LogInformation("Google token expired: {Message}", ex.Message);
}
catch (SecurityTokenException ex)
{
logger.LogWarning("Google token invalid: {Message}", ex.Message);
}
catch (HttpRequestException ex)
{
logger.LogWarning("JWKS fetch failed, falling back to session auth: {Message}", ex.Message);
}
```

### Functionality Impact

No change to auth behaviour. Improved observability only.