fix: auth failures should point at status and config edit

TLS errors already append a hint (`src/es/errors.ts`). 401/403 from ES, Kibana, or Cloud usually dump the transport body.

On 401/403 (and expired API key if we can detect it), append one hint:

- `elastic status --json` to see which service failed
- `elastic config context edit` (or the Cloud reset-credentials command when the context is a Serverless project)

Keep the original server message. Hint goes on stderr after it. `--json` puts the hint in `error.hint` so agents can parse it.

Acceptance: mock 401 on `elastic stack es ping --json` includes `error.hint` naming `elastic status`.

Start in src/es/errors.ts, where TLS errors already append hints, and trace how 401/403 responses from the ES, Kibana, and Cloud commands are rendered. Run or add the mock-401 coverage for elastic stack es ping --json; done means the original server message remains and error.hint names elastic status, with the corresponding stderr guidance.

Written by the indexing model from the issue text.