Refactor permission handling to leverage standardized "forbidden" responses and enhance unit test coverage.

services/nginx/app/routes/subusersRoute.php

@@ -79,7 +79,7 @@ class subusersRoute
             // If not admin/department permission, force restrict to effective customer
             if (!$has_permission_other) {
                 if ($effectiveCustomer === null) {
-                    $response->error('Missing customer context. Subusers must provide X-Customer-Number header.', 403);
+                    $response->forbidden([$permission_other->permission]);
                 }
                 $filters['billing_customer_number'] = (int)$effectiveCustomer;
                 $hasFilter = true; // ensure we don't fail below
@@ -673,4 +673,4 @@ class subusersRoute
             $response->success(['cvr' => $cvr, 'customer_number' => $results[0]->customerNumber]);
         });
     }
-}
+}