#41661 fix(api): return 403 for authorization failures, reserve 401 for missing session

Proposal

Fixes REST API HTTP status code semantics for authentication vs authorization failures and aligns validation errorType naming consistency across the typed router, resolving #41589.

Endpoints

ApiClass, Router, permissionsMiddleware, rooms.getMembers, rooms.hide, rooms.bannedUsers, rooms.adminRooms

Notes

• Reserve 401 status strictly for unauthenticated requests (!user / missing session).
• Remap permission denials (error-unauthorized / error-not-authorized) to 403 (forbidden).
• Align Router.ts body validation error type from invalid-params to error-invalid-params matching ajvQuery failure responses.
• Clean up dead applyBreakingChanges branch in permissions.ts middleware and update rooms.ts response schemas to validateForbiddenErrorResponse.
• Add changeset for patch release.

Task: #41589

Summary by CodeRabbit

• Bug Fixes

  • Authorization failures now consistently return 403 Forbidden; 401 Unauthorized is reserved for missing sessions.
  • Permission-denied responses are handled consistently across room, administrative, and LDAP endpoints.
  • API errors are now correctly identified across supported error formats.

• Improvements

  • Request validation errors now consistently use error-invalid-params for invalid or missing query and body parameters.
  • Updated API migration guidance and validation coverage to reflect standardized error behavior.