refactor: add DomainError::Forbidden + centralize error-to-HTTP mapping

Ownership checks (delete_review, confirm/dismiss watch events) now
return Forbidden instead of Unauthorized. Presentation layer maps
DomainError→StatusCode via domain_error_response helper, replacing
verbose per-handler match arms.

crates/presentation/src/handlers/webhook.rs

@@ -128,12 +128,7 @@ async fn run_ingest(
 ) -> StatusCode {
     match ingest_watch_event::execute(&state.app_ctx, cmd, parser).await {
         Ok(()) => StatusCode::OK,
-        Err(domain::errors::DomainError::Unauthorized(_)) => StatusCode::UNAUTHORIZED,
-        Err(domain::errors::DomainError::ValidationError(_)) => StatusCode::BAD_REQUEST,
-        Err(e) => {
-            tracing::error!("webhook ingestion failed: {e:?}");
-            StatusCode::INTERNAL_SERVER_ERROR
-        }
+        Err(e) => crate::errors::domain_error_status(&e),
     }
 }