Switch `ironrdp-client`/`ironrdp-web`/ffi to the new CredSSP API; migrate `ironrdp-web` error mapping

Move the shipped consumers onto the trait-based path, injecting the vetted backend so NLA keeps "just working."

### Scope
- [ ] `ironrdp-client`, `ironrdp-web`, and ffi call `connect_*_with(...)` with the default `ironrdp-credssp-impl` provider (convenience constructor keeps the common path a one-liner); their connect error becomes `ConnectError`.
- [ ] `ironrdp-web/src/error.rs`: map from `ConnectError`/`CredsspError::kind()` (`WrongPassword`/`LogonFailure`/`AccessDenied`) instead of matching `sspi::Error`. Any residual old `ConnectorError`-based arm may remain until #1433.

### Acceptance criteria
- Interactive NLA login works unchanged in client and web via the new path.

Start with the connect_*_with(...) call sites in ironrdp-client, ironrdp-web, and ffi, then inspect the default ironrdp-credssp-impl provider and the new ConnectError path. Read ironrdp-web/src/error.rs for the required CredsspError::kind() mappings. Done means all shipped consumers use the new path and interactive NLA login remains unchanged.

Written by the indexing model from the issue text.