Function lookup_error 

fn lookup_error(err: ModelError, unauthorized_message: &str) -> ControllerError

Classify a model lookup error raised while resolving a Bearer token.

An absent row (token, client or user missing, or the user soft-deleted) is an authentication failure and maps to 401; anything else is infrastructure and must propagate as 500. The distinction is load-bearing: langs turns a 401 into refresh-then-DELETE-credentials, so collapsing a transient DB blip into 401 would force-log-out every user for the duration of the outage.