server, ui: API should return 4XX error code for missing capability

**Describe the problem**

This isn't causing problems, but we don't return the most consistent error codes in the case of an API method being rejected because of a missing capability.

For example, in a newly started tenant in `demo` that has no capabilities, the `nodes_ui` endpoint is returning HTTP 500:

```
[An internal server error has occurred. Please check your CockroachDB logs for more details.
```

While the query endpoint for metrics returns a 401 with:

```
client tenant does not have capability to query timeseries data
```

which more appropriate. I could see 403 being the better error code here, but 401 is better than 500 for sure.

The endpoints that return 500 that I found by poking around:

- liveness
- nodes_ui
- connectivity (returns 501 Not Implemented, which is correct but isn't handled well by the ui)

Jira issue: CRDB-30794
Epic: CRDB-26691