reuse the centered auth-card shell for the 403 page so the error state matches the visual language of the rest of the app, with a primary back-to-home action.