Add HTTP error hierarchy and map it in the global error handler

Commit notes

NotFoundError/ConflictError/ForbiddenError/BadRequestError now map to their status codes; previously every business-condition throw surfaced as a 500 with the message suppressed in production. Client-caused (4xx) errors are no longer logged as server faults.

[private session redacted]