feat: what to check when access is refused, as a list, for Databricks too

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

internal/provider/azure/convert.go

@@ -280,7 +280,11 @@ func cleanError(err error) error {
 			}
 		}
 	}
-	return &serviceError{status: re.StatusCode, msg: shortenDenied(msg), err: err}
+	se := &serviceError{status: re.StatusCode, msg: shortenDenied(msg), err: err}
+	if se.status == http.StatusForbidden {
+		return &provider.Denied{Err: se, Checks: deniedChecks(se.msg)}
+	}
+	return se
 }
 
 var policyDenied = regexp.MustCompile(`does not have (\w+ \w+) permission on key vault`)
@@ -322,21 +326,23 @@ func (e *serviceError) Error() string {
 	if e.msg != "" {
 		s += ": " + e.msg
 	}
-	if e.status == http.StatusForbidden {
-		s += "\n" + deniedHint(e.msg)
-	}
 	return s
 }
 
-// deniedHint is what to check when Key Vault refuses: the network, for
-// its firewall's refusals, else access. On a line of its own, after the
-// message.
-func deniedHint(msg string) string {
+// deniedChecks are what to check when Key Vault refuses: the network,
+// for its firewall's refusals, else access.
+func deniedChecks(msg string) []string {
 	if strings.Contains(msg, "Client address is not authorized") || strings.Contains(msg, "network access") ||
 		strings.Contains(msg, "private link") {
-		return "Check: are you on a network the vault lets in (VPN, office)? Its firewall limits where it can be reached from."
+		return []string{
+			"you're on a network the vault lets in (VPN, office)",
+			"the vault's owner has let your network in",
+		}
+	}
+	return []string{
+		"your role or group is activated in PIM",
+		"the vault's owner has given you access: a Key Vault role, or its access policies",
 	}
-	return "Check: have you activated your role or group in PIM? Has the vault's owner given you access (a Key Vault role, or its access policies)?"
 }
 
 func (e *serviceError) Unwrap() error { return e.err }