Gate-correct 403 denials logged at level=error inflate error telemetry

Surfaced by PLUTO-189: /administrar/alumnos/[id] 'Sin permisos' authz denials were logged at level=error (digest 3278366549, 8 hits 06-10/11 at v1.67.22, since ceased). A gate-correct 403 is expected behavior, NOT an error — logging it at error-level inflates error clusters and could trip the error pager. Down-tier gate-correct permission denials to warn/info at the log write-path (the requireCap/withCap throw site or the error boundary that classifies it), keeping the authz/security category for the 365d retention bucket. Low-pri telemetry hygiene.