Fix HTTP status mapping for client request errors

[lovasoa]

Summary

• add small status-carrying helpers so request parsing and filesystem code can attach explicit HTTP statuses without duplicating error-wrapping boilerplate
• classify malformed form and multipart request parsing failures as client errors instead of falling back to 500
• treat filesystem NotADirectory path misses as 404 so requests that descend into files return not found instead of internal server error

Error cases and returned HTTP status

• application/x-www-form-urlencoded parse failures: preserve the Actix response status, which is a client error for malformed input
• multipart/form-data request initialization failures: preserve the Actix response status, typically 400 Bad Request or 415 Unsupported Media Type
• multipart field stream/read failures: preserve the multipart error status, such as 400 Bad Request, 413 Payload Too Large, or 500 Internal Server Error for tempfile I/O failures
• missing multipart Content-Disposition: 400 Bad Request
• invalid UTF-8 in multipart text fields: 400 Bad Request
• local filesystem NotFound and NotADirectory misses during route existence checks, metadata reads, and file reads: 404 Not Found
• local filesystem PermissionDenied during route existence checks, metadata reads, and file reads: 403 Forbidden
• invalid non-normal path components rejected by safe_local_path: 403 Forbidden
• existing top-level mapping kept centralized in src/webserver/error.rs: ErrorWithStatus is honored directly and sqlx::Error::PoolTimedOut remains 429 Too Many Requests

Testing

• cargo fmt --all
• cargo test
• cargo clippy --all-targets --all-features -- -D warnings