feat: what to check when access is refused, as a list, for Databricks too

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

internal/provider/provider.go

@@ -12,6 +12,7 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"strings"
 	"time"
 )
 
@@ -202,6 +203,23 @@ type Account struct {
 	Copy, CopyLabel string
 }
 
+// Denied is a refusal with what to check, from what the service said: a
+// role to activate in PIM, access to ask for, the network. Error is the
+// refusal, then the checks as a list.
+type Denied struct {
+	Err    error
+	Checks []string
+}
+
+func (d *Denied) Error() string {
+	if len(d.Checks) == 0 {
+		return d.Err.Error()
+	}
+	return d.Err.Error() + "\n\nCheck:\n• " + strings.Join(d.Checks, "\n• ")
+}
+
+func (d *Denied) Unwrap() error { return d.Err }
+
 // ContainerDetails is implemented by providers that can say more about a
 // container than its listing does: a vault's settings, who has access to
 // a scope, how a file is encrypted and what git knows of it. It may go