Agree a consistent 401 and 403 error shape

Problem

Each modular feature returns its own authentication and authorization failure shape. Orbit uses Grape's forbidden! and not_found! helpers; Artifact Registry is closed-by-default with its own Go handlers. A client talking to two GitLab APIs handles two error formats.

Goal

An agreed error shape for 401 and 403 across modular feature APIs, documented and reflected in each published spec.

Technical considerations

• Cheap to agree, expensive to retrofit. Worth doing before a third service ships.
• Orbit returns not_found! rather than 403 where the resource check fails, which is a deliberate information-disclosure choice. Any shared convention has to permit it rather than forbid it.