Archive an access finding as intended access

Archives an Access Analyzer finding, recording that the external access is intended and approved ("Archive" / "Archive as intended" in the UI). The finding's status transitions to Archived, it is removed from the Active facet of the findings list, and the resulting state is immediately available to subsequent reads. Archiving does not modify the underlying policy grant — it only changes the finding's triage status. Validation: the finding must exist and be visible to the caller in the active scope (NOT_FOUND otherwise); the current status must permit archiving — a finding already in Archived or Resolved is rejected with CONFLICT (409); the caller must hold a role permitted to triage findings (owner/admin/contributor), otherwise FORBIDDEN. Async & state: Synchronous command returning 200 with the updated finding (Active → Archived). A resource.updated SSE frame is emitted for the finding with kind: iam.access_finding and a patch containing the new status. Errors: 401 unauthenticated; 403 caller lacks triage permission on the scope; 404 unknown or out-of-scope finding; 409 current status does not permit archive; 500 on backend failure. Idempotency/Concurrency: This operation does not use Idempotency-Key; it may be omitted and a sent one is ignored. Archiving a finding that is already Archived (including a retry of a request that succeeded) is refused with 409 CONFLICT; the transition is never applied twice. This operation does not check If-Match; a sent one is ignored.