- Re-run AccessManager authentication before each responses websocket turn and duplex continuation using a cloned POST request with handshake headers stripped.
- Add AuthErrorCodeDenied and NewDeniedError in sdk/access so terminal provider refusals preserve their HTTP status and stop the provider chain.
- Add DenyStatusCode and DenyMessage to pluginapi.FrontendAuthResponse and map explicit plugin denials in accessAdapter.Authenticate.
Closes: #6843