fix: surface Get error instead of silently skipping MFA resolution

If fetching the connection fails (network error, auth issue, etc.),
the MFA resolution was silently skipped, sending the raw user input
to the API — reproducing the exact bug this PR fixes. Now the error
is returned immediately.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: rgarcia

cmd/auth_connections.go

@@ -456,7 +456,10 @@ func (c AuthConnectionCmd) Submit(ctx context.Context, in AuthConnectionSubmitIn
 	// whatever the user provided to the correct type value.
 	if hasMfaOption {
 		conn, err := c.svc.Get(ctx, in.ID)
-		if err == nil && len(conn.MfaOptions) > 0 {
+		if err != nil {
+			return fmt.Errorf("failed to fetch connection for MFA option resolution: %w", err)
+		}
+		if len(conn.MfaOptions) > 0 {
 			resolved := false
 			for _, opt := range conn.MfaOptions {
 				displayName := fmt.Sprintf("%s (%s)", opt.Label, opt.Type)

cmd/auth_connections_test.go

@@ -297,6 +297,23 @@ func TestSubmit_MfaOptionResolvesLabelCaseInsensitive(t *testing.T) {
 	assert.Equal(t, "sms", submittedID)
 }
 
+func TestSubmit_MfaOptionGetErrorSurfaced(t *testing.T) {
+	fake := &FakeAuthConnectionService{
+		GetFunc: func(ctx context.Context, id string, opts ...option.RequestOption) (*kernel.ManagedAuth, error) {
+			return nil, errors.New("connection not found")
+		},
+	}
+
+	c := AuthConnectionCmd{svc: fake}
+	err := c.Submit(context.Background(), AuthConnectionSubmitInput{
+		ID:          "conn-1",
+		MfaOptionID: "sms",
+		Output:      "json",
+	})
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "failed to fetch connection for MFA option resolution")
+}
+
 func TestSubmit_MfaOptionRejectsUnknown(t *testing.T) {
 	fake := newFakeWithMfaOptions([]kernel.ManagedAuthMfaOption{
 		{Label: "Get a text", Type: "sms"},