[hlx6] Empty site root shows "Not permitted" and disables create (+)

## Summary

Browsing a **hlx6 (source-bus) site that has no content yet** renders
**"Not permitted"** and leaves the create **(+)** button disabled, even for a
user with full admin/write access. It looks like an authorization failure, but
it is not — the site is simply empty. This blocks the first-content workflow:
you cannot author the first document because the UI wrongly reports no access.

Reproduce:
1. Create a hlx6 site via the admin API (config only, no content authored).
2. Open it in da.live: `#//`.
3. Observe "Not permitted" in the browse list and a disabled (+) button.

## Root cause (verified against source)

A brand-new hlx6 source-bus folder legitimately returns **404** on listing, and
da-live collapses that 404 into the same state as a real 401/403.

1. **API side — empty folder is a 404 by design.**
`listFolder()` in `helix-api-service` returns `404` when the folder listing
is empty (`src/source/folder.js`, the empty-listing branch).
A site whose source bus has zero objects (never authored, no `.props`
marker) returns `404`, distinct from `401/403`.

2. **da-nx client — 404 collapsed to `ok:false`, status dropped.**
`source.list` returns `{ ok: false }` for any non-ok response, discarding the
HTTP status (404 vs 401/403), so callers can't tell empty from denied
([`nx2/utils/api.js#L228`](https://github.com/adobe/da-nx/blob/36e7793abe48a7379e7b10374cb344bbfc4a06b0/nx2/utils/api.js#L228)).
Note also the hlx6 permission fake in `daFetch`
([`nx2/utils/api.js#L442-L443`](https://github.com/adobe/da-nx/blob/36e7793abe48a7379e7b10374cb344bbfc4a06b0/nx2/utils/api.js#L442-L443)):
`resp.permissions ??= ['read', 'write']` — but on the `ok:false` path this
never reaches the UI.

3. **da-live UI — any `!ok` becomes "Not permitted".**
`getList()` sets `_emptyMessage = 'Not permitted'` for any `!ok` result
([`blocks/browse/da-list/da-list.js#L144-L148`](https://github.com/adobe/da-live/blob/af0a03fe05ef50b0a668d1e6f5de79dc677feb32/blocks/browse/da-list/da-list.js#L144-L148)),
overriding the default `'Empty'`
([`da-list.js#L55`](https://github.com/adobe/da-live/blob/af0a03fe05ef50b0a668d1e6f5de79dc677feb32/blocks/browse/da-list/da-list.js#L55)).
Because `permissions` is never applied (`handlePermissions` only runs on the
`ok` path), the (+) create button also stays disabled.

## Expected

An empty (but accessible) hlx6 site root should render the **"Empty"** state
(the existing `_emptyMessage` default) with the **(+) create button enabled**,
so the user can author the first document. "Not permitted" should be reserved
for genuine 401/403 responses.

## Proposed fix (minimal, hlx6-scoped)

Preferred — fix in the client where the hlx6 404 quirk originates
(`da-nx/nx2/utils/api.js`, `source.list` hlx6 branch): treat a **404** listing
as an empty folder rather than a failure:

```js
if (hlx6 && resp?.status === 404) {
return { ok: true, items: [], continuationToken: null, permissions: permissions ?? ['read', 'write'] };
}
```

This keeps the fix in the hlx6 path (legacy DA already returns `200 []` for
empty folders, so it is unaffected), restores the correct "Empty" UI, and
lets the faked `['read','write']` permissions enable the (+) button.

Alternative (or additional hardening) in `da-list.js`: have `source.list`
surface the HTTP status and only show "Not permitted" for `401/403`, "Empty"
otherwise.

Start with nx2/utils/api.js source.list in the hlx6 branch, then compare its 404 handling with blocks/browse/da-list/da-list.js getList() and handlePermissions. Verify the behavior using the empty-site reproduction and existing hlx6 permission fake. Done means an accessible empty root shows “Empty” and enables (+), while genuine 401/403 responses still show “Not permitted”.

Written by the indexing model from the issue text.