Down-tier clientError:access-denied off the real-time error pager (gate-correct denials should not page)

logClientError (src/lib/client-log-actions.ts:47) logs EVERY /acceso-denegado landing at level=error AND calls sendErrorNotification -> the real-time pager fires on every authz denial. But an access-denied is an EXPECTED, gate-correct security outcome (deny-access.ts:61 redirect). Confirmed benign 2026-07-05: Elazar's alumno test-persona hit a docente-only /alumnos/[id] page, correctly bounced, paged as [error]. Same over-tiering class as PLUTO-461 (PKCE) / PLUTO-500 (banner) / notfound-capture-redirect-overfire. FIX: for kind==='access-denied' ONLY, log at warn (use the existing logWarn twin, PLUTO-461) and SKIP sendErrorNotification. KEEP: category unchanged (security-tier, 365d retention), the appEvents row still written (now warn), and kinds 'error' (real client crash) + 'not-found' UNCHANGED (still error-pager). ACCEPTANCE: a gate-correct /acceso-denegado landing writes a warn-level security-tier row and does NOT fire the error pager or error email; real client 'error' kind still pages. Pre-impl note: this is a logging-tier change, not an authz-gate change - the gate itself is correct and must not be touched.