Mark an access finding as resolved

Marks an Access Analyzer finding as resolved after the operator has removed the offending grant ("Resolve" / "Mark resolved" in the UI). The finding's status transitions to Resolved and the new state is visible to subsequent list and detail reads. The command records the triage outcome only; the analyzer will re-open a new finding on its next scan if the external access in fact still exists. Validation: the finding must exist and be visible in the active scope (NOT_FOUND otherwise); the current status must permit resolution — Resolved or Archived findings are rejected with CONFLICT (409); the caller must hold a triage-capable role (owner/admin/contributor) or the request fails with FORBIDDEN. Async & state: Synchronous command returning 200 with the updated finding (Active → Resolved). A resource.updated SSE frame is emitted for the finding with kind: iam.access_finding and a patch containing the new status. Errors: 401 unauthenticated; 403 caller lacks triage permission; 404 unknown or out-of-scope finding; 409 current status does not permit resolve; 500 on backend failure. Idempotency/Concurrency: This operation does not use Idempotency-Key; it may be omitted and a sent one is ignored. Resolving a finding that is already Resolved (including a retry of a request that succeeded) is refused with 409 CONFLICT; the transition is never applied twice. This operation does not check If-Match; a sent one is ignored.