Expose error/status callbacks on the prebuilt <SignIn /> component (e.g. incorrect password, rate limiting)

Is your feature request related to a problem?

The prebuilt <SignIn /> component (@clerk/clerk-react) handles the full sign-in flow internally but doesn't expose any way to observe failures — incorrect password, rate limiting (429s), locked accounts, etc. There's no onError prop, no emitted event, and no documented way to read the failure reason from useSignIn() when the failure happened inside the component's own internal form submission (not one we drive ourselves).

As a workaround, we've had to monkey-patch window.fetch to sniff HTTP status codes for requests to our Clerk FAPI domain, just to detect a 429 and show a "too many attempts, retry in Ns" banner:

window.fetch = async (...args) => {
  const response = await originalFetch(...args);
  if (url.includes(CLERK_DOMAIN) && response.status === 429) {
    // surface a rate-limit banner
  }
  return response;
};

This is fragile (breaks on any internal FAPI change), duplicated per-app, and can't distinguish error reasons (wrong password vs. locked vs. rate-limited) — only status codes.

Describe the solution you'd like

An onError (or onStatusChange) prop on <SignIn /> that fires with Clerk's structured error info (e.g. ClerkAPIError[] with codes like form_password_incorrect, too_many_requests) whenever an internal sign-in attempt fails — without requiring us to reimplement the form via the headless useSignIn() hook just to get error visibility.

Describe alternatives you've considered

• Rebuilding the whole sign-in form with useSignIn() to get error access — loses all the built-in UI/appearance theming <SignIn /> gives us for free.
• Patching window.fetch — fragile, non-public API surface, no error-code granularity.

Happy to contribute a PR if maintainers can point at the right place to emit this.

Start at the prebuilt entry point in @clerk/clerk-react and trace how its internal form submission handles failures. Review how ClerkAPIError[] and codes such as form_password_incorrect and too_many_requests are represented, then determine the callback behavior and coverage needed for failed sign-in attempts.