feat(oauth): access-denied page instead of redirect on gate failure

[BK1031]

When a user fails an application's required-group access gate, show a clear in-app Access denied page instead of immediately redirecting them back to the client with ?error=access_denied.

Screenshot

Backend

• ValidateAuthorize now runs CheckAccessGate (using the entity_id the SPA already sends) and returns 403 {error: access_denied, app_name} when the user doesn't qualify. So the denial is determined on landing, before the consent screen renders.
• Fails closed: a non-denial gate error (core unreachable) returns 502, consistent with the rest of the flow.
• The gate is still enforced at the authorize POST and token exchange too (defense in depth) — this just surfaces it earlier for UX.

Frontend (AuthorizePage)

• Renders a dedicated "You don't have access to {app}" page for the 403 access_denied validate response — the denied user never sees a consent screen.
• Safety net: the approve POST also catches 403 access_denied (membership can change between landing and approving) and shows the same page instead of redirecting.
• Other errors still redirect to the client per spec; genuine server errors still show the generic "Can't authorize" page.

Notes

• User-initiated Cancel still redirects with access_denied (the client should know the user declined) — only gate denials show the in-app page.
• Verified: oauth go build/vet/gofmt clean; web tsc/eslint/build clean.