When token pool is empty, surface the error to the badge consumer

Should provide better debuggability in self-hosting cases like #4862 but also on the production server.