UX improvement: make memwal_login and auth-required states easier to recover from during first-run setup

[Derojuu]

Problem:

First-time builders may see only memwal_login or may call memory tools before credentials are ready. If the agent does not explain the state clearly, the user can think the MCP server is broken.

Expected improvement:

Improve first-run guidance by showing:
- whether credentials are missing
- whether the login URL expired
- whether a browser approval is still pending
- what exact next action the user should take

Evidence to attach after testing:

- Client:
- First-run state:
- Error text:
- Recovery steps:
- Suggested wording:

[github-actions]

Thank you for opening this issue, a team member will review it shortly.