A bare Rack 3 response hash is not normalized on the way out the way
Roda response[ ]= is, and rackup development Lint turns the uppercase
name into a 500 that hides the 403. The test suite never saw this
because Rack::Test does not lint.

Assisted-by: GLM-5.3 via pi

diff --git a/lib/pro_tacts/tailscale_auth.rb b/lib/pro_tacts/tailscale_auth.rb
index 13b9bf8..b0360bc 100644
--- a/lib/pro_tacts/tailscale_auth.rb
+++ b/lib/pro_tacts/tailscale_auth.rb
@@ -45,7 +45,11 @@ module ProTacts
     #: () -> Rack::response
     def forbidden
       body = "Forbidden: no Tailscale identity on this request.\n"
-      [403, { "Content-Type" => "text/plain", "Content-Length" => body.bytesize.to_s }, [body]]
+      # Lowercase names: a bare Rack 3 response hash is not normalized
+      # on the way out the way Roda's response[ ]= is, and rackup's
+      # development Lint rejects an uppercase name with a 500 that hides
+      # the 403.
+      [403, { "content-type" => "text/plain", "content-length" => body.bytesize.to_s }, [body]]
     end
   end
 end