Preserve authorization denial reasons through to user-facing errors

When several access gates share one denial dialog, its wording cannot identify the failing gate. Preserve distinct internal reason codes for membership, team scope, and hidden-record visibility; show guidance that matches the authorized reason without exposing inaccessible data. This applies to systems where lifecycle visibility and authorization share a read path. It does not justify granting broader access or reversing a hide operation.