fix: clarify unreadable config permission errors

[hehanlin1996]

Summary

• classify C1-AUTH-PERM and implement the low-risk lark-cli-only fix for BASE-20260515-045
• preserve not-configured semantics for missing config files while surfacing unreadable config files as structured config errors
• add actionable permission-denied hints for config show, doctor --offline, and default credential resolution paths

Verification

• go test ./internal/core ./internal/credential ./cmd/config ./cmd/doctor -count=1
• go test ./cmd ./cmd/auth ./cmd/config ./cmd/doctor ./internal/core ./internal/credential -count=1
• go test -race -count=1 ./cmd/config ./cmd/doctor ./internal/core ./internal/credential
• go vet ./cmd/... ./internal/...
• gofmt -l .
• go run github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.1.6 run --new-from-rev=origin/main

No shortcut changes; dry-run E2E is not required.