`add` demands CreateDataSet scope even when the target data set already exists

The requirement is static because the preflight runs at Synapse setup, before data-set resolution — at that point the flow doesn't know whether it will create a data set or just add pieces to an existing one. So it asks for the worst case.

Consequence: a least-privilege key scoped to `AddPieces` only (exactly the kind of key the scoped-sessions feature encourages) can't run `add` against an existing data set, even though the operation it would actually perform is fully authorized. The gating error tells the owner to grant `CreateDataSet` for an upload that will never create anything.

Same pattern check is worth doing for `import` (same upload flow) when fixing.