fix(errors): return 403 from featureNotEnabled instead of 503

[vbudhram]

Because

• AppError.featureNotEnabled() responded with 503 Service Unavailable. That status tells the client the server is at fault and that a retry may work.
• Neither is true for a disabled feature flag. The server understands the request and refuses it, so 403 is correct.

This pull request

• Changes the status code in featureNotEnabled() to 403 in app-error.ts.
• Updates the errno 202 row in the API error table in auth-server-api.ts.
• Moves the two errno 202 response blocks in devices-and-sessions-api.ts from 503 to 403.
• Updates five stale status assertions in devices-and-sessions.spec.ts.
• Adds a unit test in index.spec.ts that pins both the 403 status and the 202 errno.

errno 202 is unchanged. Clients match on errno, so changing it would break them. None of the ~20 call sites pass an argument or assert on the status, so none needed edits.

Issue that this pull request solves

Closes: https://mozilla-hub.atlassian.net/browse/FXA-14339

Checklist

• My commit is GPG signed.
• If applicable, I have modified or added tests which pass locally.
• I have added necessary documentation (if appropriate).
• I have verified that my changes render correctly in RTL (if appropriate).
• I have manually reviewed all AI generated code.

Other information

featureNotEnabled() still sends a retry-after header. That was coherent on a 503 and looks out of place on a 403. I left it alone because that is a separate behavior change. It is worth a follow-up ticket.