fix(rest): the template's create refusal answers in the shared error envelope (#20896)

check:route-envelope ratchets the flat sibling-code dialect down and refused
the new 403 body; it is now built through sendError from @objectstack/types.

Claude-Session: https://claude.ai/code/session_01Sfe5YjBLwB9J3y8fvm2xq1
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

packages/rest/src/import-template-route.test.ts

@@ -286,7 +286,7 @@ describe('?template=true — the IMPORT door\'s gates decide, not the export\'s
     const builder = vi.spyOn(rest as any, 'answerImportTemplate');
     const out = await get({ template: 'true' });
     expect(out.status()).toBe(403);
-    expect(out.json()).toMatchObject({ code: 'PERMISSION_DENIED', object: 'deal' });
+    expect(out.json()).toMatchObject({ success: false, error: { code: 'PERMISSION_DENIED', details: { object: 'deal' } } });
     expect(out.body().length).toBe(0);
     expect(builder).not.toHaveBeenCalled();
     expect(getWritableFields).not.toHaveBeenCalled();
@@ -299,7 +299,7 @@ describe('?template=true — the IMPORT door\'s gates decide, not the export\'s
     const builder = vi.spyOn(rest as any, 'answerImportTemplate');
     const out = await get({ template: 'true' });
     expect(out.status()).toBe(403);
-    expect(out.json()).toMatchObject({ code: 'PERMISSION_DENIED', object: 'deal' });
+    expect(out.json()).toMatchObject({ success: false, error: { code: 'PERMISSION_DENIED', details: { object: 'deal' } } });
     expect(out.body().length).toBe(0);
     expect(builder).not.toHaveBeenCalled();
     expect(getWritableFields).not.toHaveBeenCalled();
@@ -312,7 +312,7 @@ describe('?template=true — the IMPORT door\'s gates decide, not the export\'s
     });
     const out = await get({ template: 'true' });
     expect(out.status()).toBe(403);
-    expect(out.json()).toMatchObject({ code: 'PERMISSION_DENIED' });
+    expect(out.json()?.error?.code).toBe('PERMISSION_DENIED');
     expect(out.body().length).toBe(0);
   });
 

packages/rest/src/rest-server.ts

@@ -2572,12 +2572,16 @@ export class RestServer {
             allowed = false; // access-narrowing answer → a throw is a denial
         }
         if (allowed) return false;
-        res.status(403).json({
-            code: 'PERMISSION_DENIED',
-            error: `Creating records on object '${objectName}' is not permitted for this user, `
+        // Built through the SHARED envelope (`{ success: false, error: { code,
+        // message, details } }`), not in the flat sibling-`code` dialect the
+        // export gate above still answers in — `check:route-envelope` ratchets
+        // that dialect down and refuses a new body in it.
+        sendEnvelopeError(
+            res, 403, 'PERMISSION_DENIED',
+            `Creating records on object '${objectName}' is not permitted for this user, `
                 + 'so its import template is not served',
-            object: objectName,
-        });
+            { details: { object: objectName } },
+        );
         return true;
     }