Clearer errors when forking an app fails

Failed forks used to return an opaque 500 with no server-side trace. Permission and not-found failures now surface as proper 403/404 responses, and unexpected errors are logged so they can actually be diagnosed.