fix(session): fetch the live gate when a permission answer is rejected

[RonenMars]

Summary

The client took a permission card down on gate_mismatch and unknown_option, but the streamer only clears its input gate on gate_closed.
Both codes left the gate open with nothing on screen to answer, so /input kept refusing text.
Only gate_closed now clears and suppresses the card.
The other two drop the stale card without suppression and re-send subscribe_session, so the streamer unicasts the live gate back as a fresh, answerable card.
The no-retry decision is unchanged and now has its own name, isPermissionAnswerRejectedError, separate from the teardown check isPermissionGateClosedError.

Scope

This covers the legacy /permission/answer route, which the app only uses against streamers that predate the prompt contract.
The lockout reported in #954 went through /prompt/answer, and its fix is on the streamer side: RonenMars/threadbase-streamer#849 clears the stale entry, and RonenMars/threadbase-streamer#850 fixes the answer check that left it behind.
This PR therefore references #954 rather than closing it.

Tests

• On gate_mismatch, the card drops, subscribe_session is sent, and a replayed gate with a new gateId lands active and answerable.
• On unknown_option, the replayed same gate is shown again, which is the case clear() would have swallowed.
• On gate_closed, the card clears, nothing is resubscribed, and repaints stay suppressed.
• With the old logic restored, 5 of the new tests fail; with clear() in place of resetAndUnsuppress(), 3 fail.
• The affected suites pass: 27 suites, 320 tests.

Refs #954