fix(authz): tell agents to reply now after a final board-only denial

In the plugins.configure-plugin chat eval, the agent got the final denial
with a plugin settings link and still searched the API for two more
minutes, reasoning that the request implied another route. Say to stop
working on the denied step and reply now.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

server/src/__tests__/board-access-denial.test.ts

@@ -51,6 +51,7 @@ describe("board-only denial", () => {
     expect(res.body.code).toBe(BOARD_ACCESS_REQUIRED_CODE);
     expect(res.body.remediation).toContain("this denial is final");
     expect(res.body.remediation).toContain("do not search for one");
+    expect(res.body.remediation).toContain("reply now");
     expect(res.body.remediation).toContain(link);
   });
 

server/src/routes/authz.ts

@@ -98,7 +98,7 @@ export function boardAccessRequired(req: Request) {
     : "They can do it in the Paperclip web app or with their own board credentials. Link a page only if you already know its route; do not search for one.";
   return forbidden("Board access required", {
     code: BOARD_ACCESS_REQUIRED_CODE,
-    remediation: `This action is board-only by design and this denial is final: no agent credential, tool or other API route can do it, so do not search for one. Tell the person that a board user must do it. ${where}`,
+    remediation: `This action is board-only by design and this denial is final: no agent credential, tool or other API route can do it, so do not search for one. Stop working on this step and reply now: tell the person that a board user must do it. ${where}`,
   });
 }