fix: distinguish identity denial from resource forbidden

[rdlabo]

Summary

• add an optional request/error classifier for identity-wide auth access revocation
• preserve the legacy 401/403 revocation default when the classifier is omitted
• keep status hooks and offline-fallback boundaries independent from access revocation
• document header-generation versus response-error hook dispatch

Compatibility

Existing products retain the current behavior unless they opt into the classifier. Products should opt in only after their server distinguishes unauthenticated 401 from resource-level 403.

Validation

• ng test kit --watch=false (36 files, 513 tests)
• npm run lint
• npm run prebuild:kit
• git diff --check

Review

Manager review: APPROVE

[netlify]

✅ Deploy Preview for rdlabo-ionic-angular-library ready!

Name	Link
🔨 Latest commit	7f5c9f6
🔍 Latest deploy log	https://app.netlify.com/projects/rdlabo-ionic-angular-library/deploys/6a6558a9053bd2000880b4c4
😎 Deploy Preview	https://deploy-preview-41--rdlabo-ionic-angular-library.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 1 additional finding.