auth_ephemeral: use dedicated enum type for auth return codes