A refusal raised by a database guard is shown to anyone, so its words must be written for anyone #723

Since #660 a refusal raised by a database trigger answers 403 with the trigger's message, to every caller, anonymous ones included. That is right for the guards in place today, whose messages are meant for the person refused. A guard written later could put internal detail in its message.

Acceptance criteria

• [ ] Operator guards (database triggers) document that their messages are shown to the caller, and the guard SQL in the repository says so beside each RAISE.
• [ ] Only messages with a known prefix (for example forge: ) are passed through. Any other trigger message is answered with a generic "refused" and logged in full for the operator.
• [ ] Test: a trigger with a prefixed message is shown verbatim; one without the prefix shows the generic text to an anonymous caller, and the log has the original.