IAM: /authorize yields server error when subject is not known

[reinkrul]

time="2025-04-14T11:40:00+02:00" level=warning msg="HandleAuthorizeRequest failed" error="subject not found" module=Auth/iam operation=HandleAuthorizeRequest operationID=HandleAuthorizeRequest requestURI=/oauth2/local/authorize user="<nil>"

I think we should be OK communicating the underlying error to the client.