fix(api): add missing 403 to GET /api/config and GET /api/config/service/{service}

Both handlers call requirePermission("view","config") but the spec only
declared 403 on their PUT counterparts. The regression test added in this
PR caught the gap. Add the missing 403 response to both GET operations.

Author: cristim

internal/api/openapi.yaml

@@ -100,6 +100,8 @@ paths:
                 $ref: '#/components/schemas/ConfigResponse'
         '401':
           $ref: '#/components/responses/Unauthorized'
+        '403':
+          $ref: '#/components/responses/Forbidden'
     put:
       operationId: updateConfig
       tags: [Configuration]
@@ -147,6 +149,8 @@ paths:
                 $ref: '#/components/schemas/ServiceConfig'
         '401':
           $ref: '#/components/responses/Unauthorized'
+        '403':
+          $ref: '#/components/responses/Forbidden'
         '404':
           $ref: '#/components/responses/NotFound'
     put: