docs: clarify callback access_denied causes include privilege changes

Update integration guidance so consuming apps treat access_denied as an expected provider authorization result when membership or privilege state changes during the OAuth consent flow.

docs/INTEGRATION_GUIDE.md

@@ -66,7 +66,7 @@ if (isset($_GET['error'])) {
     $error = (string) $_GET['error'];
     $description = isset($_GET['error_description']) ? (string) $_GET['error_description'] : 'Unknown provider error';
     // access_denied is a normal authorisation outcome (for example, membership
-    // revoked or user denied consent between request and submit).
+    // revoked, privilege changed, or user denied consent between request and submit).
     http_response_code($error === 'access_denied' ? 403 : 400);
     exit('Authorization failed: ' . $description);
 }