feat: add customer authentication and scoped RBAC

vehicle-data-platform/apps/api/internal/platform/handler.go

@@ -480,6 +480,8 @@ func (h *Handler) write(w http.ResponseWriter, r *http.Request, data any, err er
 		if clientErr, ok := asClientError(err); ok {
 			status := http.StatusBadRequest
 			switch {
+			case clientErr.Code == "VEHICLE_PERMISSION_DENIED":
+				status = http.StatusForbidden
 			case strings.HasSuffix(clientErr.Code, "_NOT_FOUND"):
 				status = http.StatusNotFound
 			case strings.HasSuffix(clientErr.Code, "_CONFLICT"), clientErr.Code == "ALERT_ACTION_NOT_ALLOWED":