Function classify_decision 

fn classify_decision(status: u16) -> Decision

Classifies a Keycloak UMA response status.

The split matters: a misconfigured token_endpoint answering 404, or a Keycloak having a bad day answering 502, is not “this client may not pass” — reporting it as a denial hides a broken deployment behind a plausible-looking 403.