fix: leave access denials on stateless firewalls to the plain 401/403

src/EventListener/AccessDeniedListener.php

@@ -63,13 +63,19 @@ class AccessDeniedListener implements EventSubscriberInterface
             return;
         }
 
-        /** @var Session $session */
-        $session = $request->getSession();
-
         $this->authLogger->warning('Access denied', [
             'uri' => $request->getRequestUri(),
         ]);
 
+        // API clients (/api, /mcp, webhooks) get the plain 401/403. A flash would start a
+        // session nobody reads and send a cookie, and a redirect would answer with HTML.
+        if (true === $this->security->getFirewallConfig($request)?->isStateless()) {
+            return;
+        }
+
+        /** @var Session $session */
+        $session = $request->getSession();
+
         if (null === $this->security->getUser()) {
             $session->getFlashBag()->add('info', 'Bitte melde dich an.');