fix(databases): unwrap the error envelope in the create --attach warning

`create --attach` folds a failed attach into a `warning:` line and carries
on to the next spec. It built that line with `ApiError::message`, which
formats the raw response body, so the user read the JSON envelope:

    warning: could not attach 'src': 409 Conflict: {"error":{"message":
    "this catalog is scoped to another database…","code":"CONFLICT"}}

Adds `ApiError::user_message`, the non-exiting counterpart that runs the
body through `util::api_error` the way `format_fail_message` already does
for the print-and-exit path, and uses it here. No credential probing, so
it needs no live `Api` and adds no auth hint.

Author: eddietejeda

src/client/sdk.rs

@@ -285,6 +285,28 @@ impl ApiError {
         }
     }
 
+    /// The server's own explanation, unwrapped from its JSON envelope.
+    ///
+    /// Like [`message`](Self::message), this is for errors folded inline into
+    /// another line rather than printed-and-exited. It differs in reaching for
+    /// [`util::api_error`], so `{"error":{"message":"…"}}` renders as the
+    /// sentence inside it instead of the raw body. Use this wherever the text
+    /// lands in front of a person; `message` stays the right choice when the
+    /// status code carries the meaning, or when something downstream reads the
+    /// string rather than a reader.
+    ///
+    /// Unlike [`print`](Self::print) it never probes the stored credential, so
+    /// it needs no live `Api` and adds no auth or token-scope hint.
+    pub fn user_message(&self) -> String {
+        match self {
+            ApiError::Status { status, body } if body.trim().is_empty() => {
+                format!("HTTP {status} (empty response body)")
+            }
+            ApiError::Status { body, .. } => util::api_error(body.clone()),
+            ApiError::Transport(msg) => msg.clone(),
+        }
+    }
+
     /// Print the standard error (without exiting), reproducing
     /// `ApiClient::fail_response`'s formatting.
     ///

src/commands/databases.rs

@@ -1932,7 +1932,10 @@ fn attach_connection(
     alias: Option<&str>,
 ) -> Result<String, String> {
     let connection_id = crate::commands::connections::try_resolve_connection_id(api, connection)?;
-    send_attach(api, database_id, connection_id.clone(), alias).map_err(|e| e.message())?;
+    // `user_message`, not `message`: this string is interpolated straight into
+    // a `warning:` line the user reads, so it wants the sentence out of the
+    // error envelope rather than the raw JSON body.
+    send_attach(api, database_id, connection_id.clone(), alias).map_err(|e| e.user_message())?;
     Ok(connection_id)
 }
 
@@ -4477,4 +4480,46 @@ mod tests {
             other => panic!("expected the 500 to propagate, got {other:?}"),
         }
     }
+
+    /// `create --attach` folds a failed attach into a `warning:` line and keeps
+    /// going. That line is read by a person, so it must carry the server's
+    /// sentence — not the JSON envelope carrying it.
+    #[test]
+    fn failed_attach_reports_the_servers_sentence_not_its_envelope() {
+        let mut server = mockito::Server::new();
+        // Resolution succeeds: a `conn`-prefixed argument is probed as a raw id
+        // first, so this never reaches the listing or the active-database path.
+        let probe = server
+            .mock("GET", "/v1/connections/conn_src")
+            .with_status(200)
+            .with_header("content-type", "application/json")
+            .with_body(
+                r#"{"id":"conn_src","name":"src","source_type":"managed",
+                    "synced_table_count":0,"table_count":0}"#,
+            )
+            .create();
+        let attach = server
+            .mock("POST", "/v1/databases/db_dst/catalogs")
+            .with_status(409)
+            .with_header("content-type", "application/json")
+            .with_body(
+                r#"{"error":{"message":"this catalog is scoped to another database and cannot be attached here","code":"CONFLICT"}}"#,
+            )
+            .create();
+
+        let api = Api::test_new(&server.url(), "k", Some("ws"));
+        let err = attach_connection(&api, "db_dst", "conn_src", None)
+            .expect_err("the 409 must surface as an Err the caller can warn with");
+
+        assert_eq!(
+            err, "this catalog is scoped to another database and cannot be attached here",
+            "the warning should read as a sentence, not a JSON body"
+        );
+        assert!(
+            !err.contains('{') && !err.contains("CONFLICT"),
+            "no envelope punctuation or error code should reach the user; got: {err}"
+        );
+        probe.assert();
+        attach.assert();
+    }
 }