fix: return Unauthenticated instead of PermissionDenied on token expiration

[Faizaanp]

Problem

When JWT access tokens expire (after 15 minutes), API endpoints return PermissionDenied instead of Unauthenticated. This prevents the frontend's auth interceptor from triggering automatic token refresh, forcing users to manually refresh the page.

Root Cause

Service methods checked user == nil and returned codes.PermissionDenied, but the frontend only catches codes.Unauthenticated to trigger token refresh via the refresh token cookie.

Solution

Split authentication checks to distinguish:

• Unauthenticated: No valid token / token expired → triggers automatic refresh
• PermissionDenied: Valid token but insufficient permissions → real authorization error

Changes

• idp_service.go: Fixed CreateIdentityProvider, UpdateIdentityProvider, DeleteIdentityProvider
• instance_service.go: Fixed GetInstanceSetting storage check
• memo_service.go: Fixed GetMemo visibility check
• user_service.go: Fixed UpdateUser, ListUserNotifications, UpdateUserNotification, DeleteUserNotification

Testing

1. Reduced token expiration to 30 seconds for testing
2. Created memo, waited for expiration
3. Verified automatic refresh: 401 → RefreshToken (200) → retry succeeds
4. User can continue working seamlessly without page refresh

Fixes #5448

[johnnyjoygh]

LGTM