refactor: add DomainError::Forbidden + centralize error-to-HTTP mapping

Ownership checks (delete_review, confirm/dismiss watch events) now
return Forbidden instead of Unauthorized. Presentation layer maps
DomainError→StatusCode via domain_error_response helper, replacing
verbose per-handler match arms.

crates/application/src/diary/delete_review.rs

@@ -17,7 +17,7 @@ pub async fn execute(ctx: &AppContext, cmd: DeleteReviewCommand) -> Result<(), D
         .ok_or_else(|| DomainError::NotFound(format!("review {}", cmd.review_id)))?;
 
     if review.user_id() != &requesting_user_id {
-        return Err(DomainError::Unauthorized("not your review".into()));
+        return Err(DomainError::Forbidden("not your review".into()));
     }
 
     let movie_id = review.movie_id().clone();