feat(http): implement CallError-to-HTTP error mapping (ADR-023)

Add gateway/error.rs with call_error_to_http_status,
call_error_to_http_status_with_identity, and call_error_to_http_response.
Maps the five protocol codes (NOT_FOUND/FORBIDDEN/INVALID_INPUT/TIMEOUT/
INTERNAL) to fixed HTTP statuses, splits FORBIDDEN into 401 (no identity) /
403 (identity present), maps HTTP_<status>-prefixed operation-level codes
to the status number (from_openapi fidelity), and defaults unknown
operation-level codes to 500. Retryable 503/429 errors carry a Retry-After
header when details.retry_after is present.

crates/alknet-http/src/gateway/mod.rs

@@ -4,4 +4,4 @@
 //! `/subscribe`) are the sole HTTP invoke path (ADR-042/047). See
 //! `docs/architecture/crates/http/http-server.md`.
 
-// TODO: implement
+pub mod error;