fix(openapi): publish the sharing refusal on the prognosis read

Every delegable operation states, in the contract, that it can refuse a
delegate — and the guard over the document caught this one publishing
only its module gate. One status, two reasons: the module gate's own
sentence first, the shared refusal spliced on the end, which is the
shape every other gated delegable route already uses.

docs/api/openapi.yaml

@@ -8377,6 +8377,7 @@ paths:
               schema:
                 $ref: "#/components/schemas/MoodPrognosisEnvelope"
         "401": *a1
+        "403": *a7
         "422": *a3
         "429": *a4
   /api/mood-entries/bulk:

src/lib/openapi/routes/mood.ts

@@ -35,7 +35,9 @@ import {
 import {
   dataEnvelope,
   errorEnvelope,
+  recordRefusal,
   stdResponses,
+  MODULE_DISABLED_DESCRIPTION,
   baseUpdatedAtField,
   updatedAtTokenField,
   conflictResponse409,
@@ -510,6 +512,9 @@ export const moodPaths: NonNullable<ZodOpenApiObject["paths"]> = {
             },
           },
         },
+        // Two reasons, one status: the module gate and the sharing fence both
+        // answer 403, and OpenAPI allows one response per status.
+        ...recordRefusal(MODULE_DISABLED_DESCRIPTION),
         ...stdResponses,
       },
     },