Forbidden
The credential is valid and does not reach this far (HTTP 403): a read-only JWT asked to write, or a token scoped to other collections. A subclass of Unauthorized so an existing catch (e: KdrantException.Unauthorized) keeps catching it, and a when over the sealed hierarchy stays exhaustive.
This is the failure worth acting on rather than retrying: the same request will be refused again with the same token, however long you wait.