Fix: Update comment in auto_filter to reflect expr(false) usage

Update comment from 'id IN [] = never matches' to 'expr(false) = match none'
to match the actual implementation of deny_filter().

lib/mv/authorization/checks/has_permission.ex

@@ -131,7 +131,7 @@ defmodule Mv.Authorization.Checks.HasPermission do
     cond do
       is_nil(actor) ->
         # No actor - deny access (fail-closed)
-        # Return filter that never matches (id IN [] = never matches)
+        # Return filter that never matches (expr(false) = match none)
         deny_filter()
 
       is_nil(action) ->