refactor(server): centralize db-error-to-HTTP mapping with writeDBError

[dlorenc]

Summary

• Add writeDBError(w http.ResponseWriter, op, repo string, err error) to internal/server/errors.go — a single switch over all 23 db sentinel errors mapping each to the correct ErrCode and HTTP status; unrecognised errors log at slog.Error and return 500
• Replace ~30 repetitive inline switch { case errors.Is(err, db.Err...) } blocks across 11 handler files with single writeDBError(...) calls (net: -344 / +125 lines)
• For the two handlers with custom JSON conflict bodies (handleMerge, handleRebase) and for handlers with service.ErrForbidden/service.ErrConflict, the special case is handled inline first; writeDBError handles everything else
• Remove now-unused imports ("errors", "log/slog", db package) from affected files

Error mappings added to writeDBError

Branch: ErrBranchNotFound→404, ErrBranchNotActive→409, ErrBranchExists→409, ErrBranchDraft→409
Repo: ErrRepoNotFound→404, ErrRepoExists→409
Org: ErrOrgNotFound→404, ErrOrgExists→409, ErrOrgHasRepos→409, ErrOrgMemberNotFound→404
Role: ErrRoleNotFound→404
Invite: ErrInviteNotFound→404, ErrInviteExpired→410, ErrInviteAlreadyAccepted→409, ErrEmailMismatch→403
Release: ErrReleaseNotFound→404, ErrReleaseExists→409
Other: ErrSelfApproval→403, ErrCommentNotFound→404, ErrProposalNotFound→404, ErrProposalExists→409, ErrSubscriptionNotFound→404, ErrIssueNotFound→404, ErrIssueCommentNotFound→404

Test plan

• go build ./... — clean
• go vet ./... — clean
• go test ./... -short -count=1 — all 24 packages pass; TestDockerSmoke is excluded by -short and requires GCP credentials (pre-existing infra issue unrelated to this change)

Notes

• handleDeleteBranch previously returned "branch is already merged or abandoned" for ErrBranchNotActive; writeDBError normalises this to "branch is not active" (matches the db error message and all other call sites)
• server.go requireRepoReadAccess intentionally left unchanged — it maps ErrRoleNotFound to 403 (access denied), not 404, which is semantically different from writeDBError's mapping
• Opportunities: the TestDockerSmoke infrastructure issue is worth a separate fix (GCP credentials in CI)

🤖 Generated with Claude Code