fn is_access_denied(e: &AppError) -> bool
Detect whether an AppError represents an access-denied condition from S3.
AppError
Used by copy_object_with_fallback to decide whether to attempt the download+upload fallback path.
copy_object_with_fallback