Fix IAM token endpoint to return 400 for unknown subject

[Copilot]

The IAM token endpoint (/oauth2/{subjectID}/token) was returning HTTP 500 when the subject didn't exist. This should be a client error (400) with a proper OAuth2 error response.

Changes

• HandleTokenRequest: Convert ErrSubjectNotFound to OAuth2Error with invalid_request code
• Test coverage: Added test case for unknown subject scenario

This follows the existing pattern in OpenIDConfiguration and other endpoints.

Before

HTTP/1.1 500 Internal Server Error
{"detail":"server returned HTTP 500 (expected: 200)","status":500,"title":"RequestServiceAccessToken failed"}

After

HTTP/1.1 400 Bad Request
{"error":"invalid_request","error_description":"subject not found"}

Original prompt

---

This section details on the original issue you should resolve

<issue_title>IAM: Requesting access token for unknown subject (on remote server) yields error 500</issue_title>
<issue_description>Client responds:

{"detail":"server returned HTTP 500 (expected: 200)","status":500,"title":"RequestServiceAccessToken failed"}

Server logs:

level=warning msg="HandleTokenRequest failed" error="subject not found" module=Auth/iam operation=HandleTokenRequest operationID=HandleTokenRequest requestURI=/oauth2/d8e49bf4-9b89-42b5-bd5f-05b720eb1e74/token user="<nil>"

This should probably a status 400 with something more explanatory.</issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes IAM: Requesting access token for unknown subject (on remote server) yields error 500 #3974

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[qltysh]

Coverage Impact

⬆️ Merging this pull request will increase total coverage on master by 0.03%.

Modified Files with Diff Coverage (1)

Rating	File	% Diff	Uncovered Line #s
	auth/api/iam/api.go	100.0%
	Total	100.0%

🚦 See full report on Qlty Cloud »

🛟 Help

• Diff Coverage: Coverage for added or modified lines of code (excludes deleted files). Learn more.

• Total Coverage: Coverage for the whole repository, calculated as the sum of all File Coverage. Learn more.

• File Coverage: Covered Lines divided by Covered Lines plus Missed Lines. (Excludes non-executable lines including blank lines and comments.)

  • Indirect Changes: Changes to File Coverage for files that were not modified in this PR. Learn more.

[qltysh]

1 new issue

Tool	Category	Rule	Count
qlty	Structure	Function with many returns (count = 7): HandleTokenRequest	1

[reinkrul]

Fixed by #4003