Both sentinels had the identical message "user not found", making them indistinguishable in logs and error responses. Rename the auth variant to "auth user not found" so debugging and error matching are unambiguous.
