Fix access-rule SQL errors being returned as Forbidden

[royalcala]

Summary

• classify record-level access-rule evaluation failures as internal access-check errors
• keep Forbidden only for real authorization denials
• add stable client-facing code ACCESS_CHECK_EVAL_FAILED
• propagate the distinction across HTTP and subscription flows (SSE/WS)
• align error-detail exposure with runtime dev mode

Behavior changes

• SQL/runtime failures while evaluating access rules are no longer reported as forbidden
• in non-dev mode, clients get stable code without sensitive internals
• in dev mode, additional diagnostic detail is included

Linked issue

Closes #236