feat(12.1-01): cabana.ForbiddenError answers a refused write with 403

- hooks and bulk, record, toolbar and widget actions may return it
- 403 forbidden with the localized message and field details; the write's
  transaction is rolled back; other errors stay the opaque 500
- form shows a refused save as a persistent banner and keeps the values;
  a refused delete is a toast
- smoke tests, OpenAPI notes, dist, README, docs

modules/phrasebook/backend/lang/en/lang.yaml

@@ -94,6 +94,7 @@ form:
   action_confirm: "Run “:action” on this record?"
   action_done: Action completed.
   action_stale: This action no longer applies to this record. The page has been refreshed.
+  forbidden: You do not have permission to make this change. Nothing was saved.
 relation:
   add: Add
   link: Link

modules/phrasebook/backend/lang/pl/lang.yaml

@@ -104,6 +104,7 @@ form:
   action_confirm: "Wykonać „:action” na tym rekordzie?"
   action_done: Akcja została wykonana.
   action_stale: Ta akcja nie dotyczy już tego rekordu. Strona została odświeżona.
+  forbidden: Nie masz uprawnień do wprowadzenia tej zmiany. Nic nie zostało zapisane.
 relation:
   add: Dodaj
   link: Dołącz