Fix error URLs and disambiguate error code 40300

[flossypurse]

Summary

• Update error documentation URLs from /operate/errors to /debug/errors (3 occurrences in error.go)
• Add new StatusForbiddenPrefix (40310) for JWT auth "unauthorized prefix" errors, so 40300 is no longer overloaded for both auth and promise immutability
• StatusForbidden (40300) is now reserved for "promise already resolved" per the error docs

This is part of the composite debugging/developer UX improvement tracked in resonatehq/resonatehq-workq#6.

Resolves #1014

Related PRs

• Docs: resonatehq/docs.resonatehq.io (fix/error-codes-docs)
• Python SDK: resonatehq/resonate-sdk-py (fix/registry-error-codes)

Test plan

• go build ./... passes
• go test ./internal/kernel/t_api/... ./internal/api/... ./internal/app/subsystems/api/... passes
• Verify JWT auth errors now return code 40310 instead of 40300

🤖 Generated with Claude Code

[codecov]

Codecov Report

❌ Patch coverage is 50.00000% with 3 lines in your changes missing coverage. Please review.
✅ Project coverage is 51.78%. Comparing base (3625ce7) to head (dcbc851).

Files with missing lines	Patch %	Lines
internal/kernel/t_api/status.go	0.00%	2 Missing ⚠️
internal/app/subsystems/api/error.go	66.66%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1027      +/-   ##
==========================================
- Coverage   51.80%   51.78%   -0.02%     
==========================================
  Files         110      110              
  Lines       10478    10480       +2     
==========================================
- Hits         5428     5427       -1     
- Misses       4637     4639       +2     
- Partials      413      414       +1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.