Fix bitwarden-runcmd swallowing unrecognized bw errors as nil

bitwarden-runcmd returned nil for any bw CLI error that wasn't "vault is
locked" or "more than one result found", which crashed
bitwarden--auto-cmd's string-match on nil and, once patched around that,
silently misreported the failure as a success. It also discarded stderr
entirely, so even a fixed classification would carry no error text.

- Preserve unrecognized errors as bitwarden--err-unknown-prefixed output
  instead of nil.
- Classify that prefix in bitwarden--auto-cmd as a real failure.
- Merge stderr into stdout in bitwarden--raw-runcmd so the actual bw
  error message is captured instead of discarded.

bitwarden.el

@@ -98,6 +98,11 @@ Set this to a function that will evaluate to a string (the API client id)."
 (defconst bitwarden--err-logged-in "you are not logged in")
 (defconst bitwarden--err-multiple  "more than one result found")
 (defconst bitwarden--err-locked    "vault is locked")
+(defconst bitwarden--err-unknown   "unrecognized bw error: "
+  "Prefix marking a `bw' failure that does not match a known error string.
+`bitwarden-runcmd' prepends this so `bitwarden--auto-cmd' can still tell the
+result apart from a successful command, while keeping the raw `bw' output
+attached for diagnosis.")
 
 ;===================================== util ====================================
 
@@ -125,7 +130,7 @@ second element being the output."
                  nil               ;; input
                  (list
                   (current-buffer) ;; stdout
-                  nil)             ;; TODO capture stderr - nil, t (mixing with stdout) or file name string
+                  t)                ;; merge stderr into stdout so callers see the real bw error text
                  nil               ;; re-display buffer
                  (cons cmd args))
           (replace-regexp-in-string "\n$" ""
@@ -144,7 +149,7 @@ for common errors."
                 output
               (cond ((string-match "^More than one result was found." output)
                      bitwarden--err-multiple)
-                    (t nil))))
+                    (t (concat bitwarden--err-unknown output)))))
         bitwarden--err-locked)
     bitwarden--err-logged-in))
 
@@ -340,6 +345,8 @@ password if successful."
      ((or (string-match bitwarden--err-logged-in res)
           (string-match bitwarden--err-multiple res))
       (list 2 (format "error: %s" res)))
+     ((string-match bitwarden--err-unknown res)
+      (list 1 (format "error: %s" res)))
      (t (list 0 res)))))
 
 ;;;###autoload