ApiError status preservation

Trap: wrapping an HTTP failure in generic CliError looks useful for adding context, but discards ApiError.status, detail, and endpoint, causing expected 401–499 responses to reach Sentry. Fix: rethrow new ApiError(message, error.status, error.detail, error.endpoint) with a terse message because ApiError.format() appends detail and endpoint.