[krishicks]

Summary

Gateway handlers now record each refusal and build its status in one call, so a refusal can no longer reach the caller without its OCSF event, or carry an event that disagrees with the status:

• Who: gateway contributors adding authorization or credential checks to handlers.
• What: audit::deny emits an authorization denial and returns the permission-denied status. audit::reject_credential emits an Authentication failure for a credential a handler verifies itself and returns the rejection's status.
• Why: each refusal previously paired an emit_* call with a hand-built status. Nothing kept the two together, and the feat(auth): emit structured gateway authentication and authorization events #2912 PRs added about twenty such pairs.

Callers receive the same status codes and messages, and the events are unchanged.

Related Issue

Refs #2912

This is a follow-up refactor for #2912 and does not close it. Stacked on #4762.

Changes

• audit::deny replaces emit-then-refuse in the sandbox guards, workspace authorization, workspace role assignment, mutation admission, and the GetCurrentUser, IssueSandboxToken, and RefreshSandboxToken handlers. Three sites keep the separate calls because they emit conditionally or reuse a status built elsewhere.
• audit::reject_credential replaces emit_credential_failure for SSH session tokens and IssueSandboxToken's runtime-identity checks. RefreshSandboxToken now takes its path and origin from the request scope that the router sets for every authenticated call, as the other handlers do, instead of rebuilding them from the request.
• One Authentication builder. Failure and logon events share a base that sets the service, request path, protocol, source endpoint, and request ID.
• Labels on the enums. AuthMechanism::as_str and AuthFailureReason::as_str replace the mapping functions in audit.rs. The logon record keys on the mechanism's label instead of its Debug name; it is in-memory only, so nothing persisted changes.

Testing

• cargo nextest run -p openshell-server: all 2,397 tests pass.
• cargo clippy -p openshell-server --all-targets -- -D warnings
• Unit tests updated: the refresh replay test now runs inside the routed request scope, which is how production calls the handler, instead of injecting the origin as request extensions.
• E2E tests added or updated: not applicable.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)

[TaylorMutch]

Reviewed the complete incremental diff at 1fccc5c against #4762. No actionable findings. Shared denial and rejection helpers preserve status codes, messages, event fields, and protocol labels; refresh auditing uses the router-established request context. CI caveat: x86 Linux failed in sandbox_forward_background_tracks_owned_child_when_pid_discovery_fails because the fake SSH listener encountered AddrInUse. This CLI fixture is outside the changed code; ARM Linux, macOS, and the descendant #4778 checks pass. No local tests run.