fix(api)!: return 403 for authorization failures, reserve 401 for missing session - #41590

Conclusion: failure

Steps

• ✅ No merge conflicts
• ❌ QA assured — This PR is missing the 'stat: QA assured' label
• ✅ Mergeable
• ✅ Has milestone or project
• ✅ Valid PR title
• ❌ Correct target version — Targeting wrong base: should target 9.0.0, but targets 8.8.0