fix: classify CI token refresh communication failures

[facundo-herodevs]

Closes https://github.com/neverendingsupport/data-and-integrations/issues/757

What This Branch Does

This branch improves CI-token refresh failures in the CLI so null, malformed, or transport-level HeroDevs API responses are no longer surfaced as “CI token is invalid or expired.” It adds explicit communication-failure classification in the CI token client, maps those failures to a new CLI-facing error code/message, and keeps scan eol output user-facing instead of exposing internal error class names.

CI Token Refresh Classification

• Adds CITokenCommunicationError plus the centralized classifyCiTokenError() helper in src/api/ci-token.client.ts, so GraphQL responses with no recognized extensions.code, null payloads, missing accessToken, and transport failures all land in the communication-failure path.
• Wraps both getOrgAccessTokens() and callGetOrgAccessTokensInternal() in the same classification logic, so provisioning and refresh flows now behave consistently.
• Leaves explicit auth failures on the structured ApiError path when the server provides a known GraphQL error code.

CLI Messaging

• Extends CITokenErrorCode in src/service/ci-auth.svc.ts with CI_TOKEN_COMMUNICATION_FAILED and maps requireCIAccessToken() to the new “error communicating with the HeroDevs server” message for communication-like failures.
• Updates ScanEol.run() in src/commands/scan/eol.ts to fetch auth state through the new getTokenSourceForScan() helper, so auth/CI failures are rendered with this.error(getErrorMessage(error)) instead of leaking CITokenError: in terminal output.