fix(idaa): add reload button to Access Denied screen in iframe mode

WHY: Novi UUID verification is async — on first iframe load the API call
may not complete before the access gate renders, leaving the user stuck on
Access Denied with no way to retry without manually reloading the host page.
The Reload/Retry button calls location.reload() to re-trigger verification.
Only shown in iframe mode where the timing race is the known failure path.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/routes/idaa/(idaa)/+layout.svelte

@@ -251,5 +251,21 @@ async function verify_novi_uuid(
         {:else}
             <p>IDAA Novi UUID not found!</p>
         {/if}
+
+        {#if $ae_loc.iframe}
+            <!-- WHY: In iframe mode the Novi UUID is passed via URL param on first load.
+                 If verification hasn't completed yet (timing race on Novi API), the user
+                 lands on Access Denied. Reloading the iframe re-triggers verification. -->
+            <button
+                type="button"
+                class="btn btn-sm preset-tonal-primary border-primary-500 mt-4 border"
+                onclick={() => location.reload()}>
+                <span class="fas fa-redo m-1"></span>
+                Reload / Retry
+            </button>
+            <p class="mt-1 text-xs text-gray-500">
+                If your session just started, try reloading.
+            </p>
+        {/if}
     </div>
 {/if}