machine-readable reason from firmware (e.g. "needs_auth", "token_missing", "token_expired"). Empty string when unknown.