L-10: E-16 answers not_found for another user's device (D-156)

A member naming the other user's device now gets the same 404 not_found
body as an unknown id, so E-16 no longer reveals whose a device id is.
The admin keeps revoking any device except the current one (AC-3.2, §8.4).
contracts/openapi.yaml drops the 403 on E-16 and states the rule;
web/src/api/schema.d.ts regenerated. The forbidden test becomes a
not_found test, plus one asserting the body equals the unknown-id body
and that nothing was revoked.

Also bumps ctutils 0.4.3 -> 0.4.4 (lockfile only) for RUSTSEC-2026-0385,
published 2026-10-23, which failed cargo audit on main.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TQd3pEP9UeN2uifbHknQ7B

web/src/api/schema.d.ts

@@ -239,7 +239,7 @@ export interface paths {
         post?: never;
         /**
          * E-16 Revoke a device
-         * @description Revoking an already revoked device is 204. Admin any device except the current one; member own devices except the current one (SPEC §8.4).
+         * @description Revoking an already revoked device is 204. Admin any device except the current one; member own devices except the current one, and a device of the other user is 404 `not_found`, the same answer as an unknown id (SPEC §8.4, D-156).
          */
         delete: operations["revokeDevice"];
         options?: never;
@@ -1887,8 +1887,6 @@ export interface operations {
                 content?: never;
             };
             401: components["responses"]["Unauthorized"];
-            /** @description `forbidden`. */
-            403: components["responses"]["Forbidden"];
             /** @description `not_found`. */
             404: components["responses"]["NotFound"];
             /** @description `cannot_revoke_current_device`. */