The Server That DDoS'd Itself: Debugging a Production 403 That Fooled Everyone

A production e-commerce site went down. Every API call returned Forbidden. Cache clears didn't help. Redeploys didn't help. Permission fixes didn't help — because the application was never broken in t