api/auth: return forbidden instead of unauthorized in addUserToTeam

The client is properly detecting errors, but we're returning the wrong
error. We should not return "unauthorized" when the user is actually
"forbidden" to execute the request. Well, that's confusing.

Related to #1006.
docs/releases/tsr: add fix to issue #1006 to 0.10.0 notes

Fix #1006.