Answer
Adding an IEEE754Compatible=true header to the request has resolved this specific 401 behavior for at least one universal-connector integration tool calling standard projections — if a tool authenticates successfully against integration-type projections but fails specifically against standard projections with the same credentials, this header is worth trying before assuming a deeper IAM/client configuration problem.