Plugin and skill sync now tolerate entitlement-denied (403/404) responses instead of failing

What

• The plugin skill search route now treats an HTTP 404 with error type not_found_error the same way it already treated a 403: both degrade to an empty result and log an entitlement-denied event.
• The background skills-sync routine now recognizes a 404 not_found_error response as "not entitled" rather than a failure: it logs skills_sync_list_refused, proceeds as if zero skills were returned, and reports the round's outcome as not_entitled instead of counting it toward consecutive failed rounds or firing generic error telemetry.
• The plugin-sync routine similarly no longer hard-fails when the server's plugin list call is refused for what looks like an entitlement reason; it logs a warning, falls back to the previously-known plugin list, and reports a distinct not_entitled outcome instead of list_failed.

Why Previously these sync paths could treat a "you're not entitled to this" response from the server the same as a real error, which could count against failure thresholds or block plugin/skill functionality unnecessarily. Now they degrade gracefully, keeping the client usable and clearly distinguishing "not entitled" from "broken."