fix(s41): close review WARN — OSError refusal + scheme/profile branch coverage

Post-hoc /trekreview (WARN, scope 0670b2a..b513e64) surfaced 2 findings, both closed:
- MAJOR MISSING_TEST: the non-https scheme guard (preflight.py:61) and non-azure
  profile refusal (:82-86) had zero test coverage — added
  test_non_https_endpoint_refused + test_non_azure_profile_refused so an inverted
  condition can't regress silently.
- MINOR MISSING_ERROR_HANDLING: an existing-but-unreadable PORTFOLIO_MODEL_MAP
  raised PermissionError (an OSError, not ValueError) past the except at :95 →
  widened to OSError (subsumes FileNotFoundError). test_unreadable_override_is_
  structured_refusal proves the traceback-free invariant (red pre-fix).

Suite 348->351/4, ruff+format+mypy clean.

src/portfolio_optimiser/preflight.py

@@ -92,7 +92,9 @@ def check_azure_preflight(profile: Profile | str = Profile.AZURE) -> PreflightOK
         # Placeholder refusal: resolving each role raises ValueError on a REPLACE-WITH-* id.
         for role in _ROLES:
             resolve_model(prof, role)
-    except (FileNotFoundError, ValidationError, ValueError) as exc:
+    except (OSError, ValidationError, ValueError) as exc:
+        # OSError subsumes FileNotFoundError AND PermissionError: an existing-but-unreadable
+        # PORTFOLIO_MODEL_MAP (read_text after is_file()) must refuse cleanly, never traceback.
         return PreflightRefusal(str(exc))
     return PreflightOK(prof)