[hlx6] Empty site root shows "Not permitted" and disables create (+)

[benpeter]

Summary

Browsing a hlx6 (source-bus) site that has no content yet renders
"Not permitted" and leaves the create (+) button disabled, even for a
user with full admin/write access. It looks like an authorization failure, but
it is not — the site is simply empty. This blocks the first-content workflow:
you cannot author the first document because the UI wrongly reports no access.

Reproduce:

1. Create a hlx6 site via the admin API (config only, no content authored).
2. Open it in da.live: #/<org>/<site>.
3. Observe "Not permitted" in the browse list and a disabled (+) button.

Root cause (verified against source)

A brand-new hlx6 source-bus folder legitimately returns 404 on listing, and
da-live collapses that 404 into the same state as a real 401/403.

1. API side — empty folder is a 404 by design.
   listFolder() in helix-api-service returns 404 when the folder listing
   is empty (src/source/folder.js, the empty-listing branch).
   A site whose source bus has zero objects (never authored, no .props
   marker) returns 404, distinct from 401/403.

2. da-nx client — 404 collapsed to ok:false, status dropped.
   source.list returns { ok: false } for any non-ok response, discarding the
   HTTP status (404 vs 401/403), so callers can't tell empty from denied
   (nx2/utils/api.js#L228).
   Note also the hlx6 permission fake in daFetch
   (nx2/utils/api.js#L442-L443):
   resp.permissions ??= ['read', 'write'] — but on the ok:false path this
   never reaches the UI.

3. da-live UI — any !ok becomes "Not permitted".
   getList() sets _emptyMessage = 'Not permitted' for any !ok result
   (blocks/browse/da-list/da-list.js#L144-L148),
   overriding the default 'Empty'
   (da-list.js#L55).
   Because permissions is never applied (handlePermissions only runs on the
   ok path), the (+) create button also stays disabled.

Expected

An empty (but accessible) hlx6 site root should render the "Empty" state
(the existing _emptyMessage default) with the (+) create button enabled,
so the user can author the first document. "Not permitted" should be reserved
for genuine 401/403 responses.

Proposed fix (minimal, hlx6-scoped)

Preferred — fix in the client where the hlx6 404 quirk originates
(da-nx/nx2/utils/api.js, source.list hlx6 branch): treat a 404 listing
as an empty folder rather than a failure:

if (hlx6 && resp?.status === 404) {
  return { ok: true, items: [], continuationToken: null, permissions: permissions ?? ['read', 'write'] };
}

This keeps the fix in the hlx6 path (legacy DA already returns 200 [] for
empty folders, so it is unaffected), restores the correct "Empty" UI, and
lets the faked ['read','write'] permissions enable the (+) button.

Alternative (or additional hardening) in da-list.js: have source.list
surface the HTTP status and only show "Not permitted" for 401/403, "Empty"
otherwise.