sec(api): authenticated callers can still tell a missing execution from an existing one on approve, cancel and revoke #597

Found in the review of PR #594 (closes #435, which covers only the no-session case). After #594, a caller with no valid session gets the same 401 whether or not the execution id exists. Authenticated callers still see a difference: a session without RBAC or a contact-email match gets 404 for a missing id and 403/409 for an existing one, and a signed-in caller without the CSRF header gets 403 'CSRF validation failed' for an existing id and 404 for a missing one (CSRF only runs inside approvePurchaseViaSession, cancelPurchaseViaSession and tryRevokeViaSession). Exposure is limited: it needs a valid session and execution ids are UUIDv4.

Acceptance: decide whether authorization should run before the lookup for authenticated callers too (same status and body for missing vs not-authorized), implement with a regression test through HandleRequest comparing missing vs existing for a session without RBAC and without the CSRF header. Related: #435, #594, #587.