Casework task grants: add refusal test coverage

[jeremi]

Follow-up to #1029.

Task grant refusal paths in registry-casework that have no test:

• Unknown grant id at GET /v1/task-grants/{grant_id}/status and at POST /v1/task-grants/{grant_id}/assertion returns 404, never {active: false}
• A status caller that is not listed in status_clients gets 403 (the existing case is registered for a different resource, so it only reaches the 404 path)
• An agent assertion token at the status route, and a service status token at the assertion route
• A revoke that lands during the source read in active_task (the re-check after the read; the existing slow-source test covers only the deadline half)
• Two approvals of the same proposal in parallel, with the same idempotency key and with different keys
• An assertion for a grant past its deadline but not yet invalidated gets 403 (only the status side of expiry is tested)