templates: add error box component and error page template

Add errorBox() and errorIcon() to the design system, mirroring the
existing successBox()/checkboxIcon() pattern with red error styling.
Extract error color constants from the inline values in statusMessage().

Add AuthError() template that renders a styled HTML error page using
the same HtmlStructure/mdTypesetBody/logo/footer as all other
browser-facing pages.

Updates juanfont/headscale#3182

hscontrol/templates/auth_error.go

@@ -0,0 +1,41 @@
+package templates
+
+import (
+	"github.com/chasefleming/elem-go"
+)
+
+// AuthErrorResult contains the text content for an error page shown
+// to users in their browser when a browser-facing operation fails
+// (OIDC callback, SSH check, registration confirmation, etc.).
+type AuthErrorResult struct {
+	// Title is the browser tab / page title,
+	// e.g. "Headscale - Error".
+	Title string
+
+	// Heading is the bold red text inside the error box,
+	// e.g. "Forbidden".
+	Heading string
+
+	// Message is the actionable user-facing message shown below
+	// the heading, e.g. "You are not authorized. Please contact
+	// your administrator."
+	Message string
+}
+
+// AuthError renders a styled error page for browser-facing failures.
+// The caller controls every user-visible string via [AuthErrorResult].
+func AuthError(result AuthErrorResult) *elem.Element {
+	box := errorBox(
+		result.Heading,
+		elem.Text(result.Message),
+	)
+
+	return HtmlStructure(
+		elem.Title(nil, elem.Text(result.Title)),
+		mdTypesetBody(
+			headscaleLogo(),
+			box,
+			pageFooter(),
+		),
+	)
+}