fix(client): separate isError from !data check in effective permissions view

- Distinguish between 403 and other errors with specific messages
- Use destructive color for error state vs muted for missing data