Deny reasons beat silent 403s

A bare 403 tells the client “no.” It does not tell the engineer why. When an authorization check fails, return a stable reason code alongside the deny — missing role, wrong tenant, relationship not fo