sec(api): unauthenticated cancel/revoke distinguish missing (404) from existing (401) executions #435

Found in the review of #381. For a caller with no session and no token, cancel and revoke return 404 for a missing execution ID but 401 for an existing one: an existence oracle. Low severity (execution IDs are unguessable UUIDs), but for consistency return the same response (401) for both before any lookup, or check auth before loading the execution.