feat: what to check when access is refused, as a list, for Databricks too

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

docs/databricks.md

@@ -13,6 +13,10 @@ Secrets in Azure Key Vault-backed scopes are read through Databricks; if
 Databricks refuses, lazysecrets reads the backing vault directly with your
 az login (which then needs the [Key Vault roles](azure.md#permissions)).
 
+When Databricks refuses, the pane says what to check: access to the
+workspace and READ on the scope, or, when the workspace's IP access list
+refused, the network you're on.
+
 On a scope, the right pane shows who has access to it and how much
 (manage, write, read). Databricks shows that only to the scope's
 managers; to others it says so.