feat: when a vault refuses, what to check: PIM, the owner, or the network

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

docs/azure.md

@@ -40,8 +40,10 @@ vault resources (e.g. *Reader*). Key Vault data-plane access is separate
 | read secret values | *Key Vault Secrets User* |
 | read certificate details | *Key Vault Certificate User* |
 
-A missing permission is shown in the pane, including the action that was
-denied.
+A missing permission is shown in the pane, shortened to what was denied
+(the action, or the access policy permission), with what to check: a
+role or group to activate in PIM, access from the vault's owner, or, when
+its firewall refused, the network you're on.
 
 ## Vaults you can't discover