security(spp_api_v2): "exists but no consent" 403 has no timing jitter, unlike "not found" [Severity: Low] #559

Problem

For consent-requiring clients the API answers both "record not found" and "no consent" with 403 Access denied, to
prevent enumeration. The "not found" path adds a 50-70ms delay to mimic the
consent check, but the "found, no consent" paths return immediately — e.g. read_individual
(spp_api_v2/routers/individual.py, after filter_response) and bulk export (routers/bulk.py, consent-denied items).
Response timing can therefore still separate "exists" from "missing".

PR #555 added a shared deny_access() helper (spp_api_v2/utils/registrant_lookup.py) that applies the same jitter;
it is used for the not-found, ambiguous-identifier and ProgramMembership paths.

Proposal

Use the jittered refusal on every consent-denied 403 (or make both paths take comparable time), and add a test that the
consent-denied path goes through it.

Context

Found in the adversarial review of PR #555 (#554); pre-existing.