Fix HTTP status codes: use 403 for authorization failures on authenticated users

[Copilot]

The codebase was incorrectly returning 401 (Unauthorized) when authenticated users lacked permission to access resources. Per HTTP semantics, 401 indicates authentication failure (missing/invalid credentials), while 403 indicates authorization failure (authenticated but insufficient permissions).

Changes

Handler fixes - Changed 401 to 403 for ownership/permission checks:

• internal/handlers/llm_services.go: 4 occurrences
  • Share/unshare definition endpoints (lines 306, 356)
  • Create instance from shared definition (line 577)
  • Share instance endpoint (line 852)
• internal/handlers/projects.go: 1 occurrence
  • Share project endpoint (line 440)

Test updates:

• internal/handlers/llm_services_sharing_test.go: Updated expectation for access denied scenario (403 instead of 401)

Example change:

// Before: Authenticated user who isn't the owner gets 401
if definition.Owner != ctx.Value(auth.AuthUserKey).(string) {
    return nil, huma.Error401Unauthorized(...)
}

// After: Authenticated user who isn't the owner gets 403
if definition.Owner != ctx.Value(auth.AuthUserKey).(string) {
    return nil, huma.Error403Forbidden(...)
}

All affected cases involved checks where AuthUserKey was already set in context (user authenticated) but authorization failed (not owner/no access). Error messages normalized to lowercase for consistency.

Original prompt

See if the distinction between error responses 401 and 403 is followed correctly and consistently.

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[awagner-mainz]

Looks good.