Why does Spring Security return 401 for one failure and 403 for another, and how do you customize each?

401 Unauthorized means authentication itself failed or is missing (no valid credentials at all), handled by a custom `AuthenticationEntryPoint`. 403 Forbidden means the caller IS authenticated but lacks permission for this specific resource, handled by a custom `AccessDeniedHandler`. Confusing the two in your error responses misleads API consumers about whether they need to log in again or simply don't have access.