Returning 401 status without WWW-Authenticate header

[Backend is returning HTTP status 401 in a few places](https://github.com/getodk/central-backend/blob/d8181acab5dd000eac6d60d0df976f1e91701147/lib/util/problem.js#L114-L119), and I can't see any inclusion of a `WWW-Authenticate` header.

> The server generating a 401 response MUST send a [WWW-Authenticate](https://www.rfc-editor.org/rfc/rfc9110#field.www-authenticate) header field
> -- _https://www.rfc-editor.org/rfc/rfc9110#status.401_

Start in lib/util/problem.js at lines 114-119 and trace the few backend paths that return HTTP 401. Compare their responses with the linked RFC 9110 requirement and determine the appropriate WWW-Authenticate behavior; the work is done when each affected 401 response includes the required header.

Written by the indexing model from the issue text.