L-10: E-16 answers not_found for another user's device (D-156)

A member naming the other user's device now gets the same 404 not_found
body as an unknown id, so E-16 no longer reveals whose a device id is.
The admin keeps revoking any device except the current one (AC-3.2, §8.4).
contracts/openapi.yaml drops the 403 on E-16 and states the rule;
web/src/api/schema.d.ts regenerated. The forbidden test becomes a
not_found test, plus one asserting the body equals the unknown-id body
and that nothing was revoked.

Also bumps ctutils 0.4.3 -> 0.4.4 (lockfile only) for RUSTSEC-2026-0385,
published 2026-10-23, which failed cargo audit on main.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TQd3pEP9UeN2uifbHknQ7B

server/Cargo.lock

@@ -496,9 +496,9 @@ dependencies = [
 
 [[package]]
 name = "ctutils"
-version = "0.4.3"
+version = "0.4.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "03bb0e1cc970d482d121d9a1744999169b69a07470b3d644a7894e53fcaf4574"
+checksum = "12218662ccac37d9714f2191252553d67585b97df8c839cbe49e0bde278dc865"
 dependencies = [
  "cmov",
 ]