fix(comment): keep the 403 / 404 of comment updates instead of a 400
Problem
CommentUpdateHandler (and CommentCreateHandler) turned every error into a BadRequestException. CommentService.update throws ForbiddenException when the caller may not edit the comment, so clients got 400 instead of 403.
Fix
Rethrow HttpExceptions as they are; wrap only other errors in a 400. The create handler gets the same treatment for consistency.
Tests
New comment.handlers.spec.ts: a 403 from the update and a 404 from the create pass through; a plain Error still becomes a BadRequestException in both.
Notes
Not built or run locally.
Summary by cubic
Comment updates and creates now keep the comment service's HTTP errors instead of turning them into 400s. The handlers rethrow HttpExceptions as-is — such as the 403 CommentService.update raises for someone else's comment — and wrap only non-HTTP errors in a BadRequestException.
CommentService likewise stops converting its own client errors to 400s: a missing comment or author employee now surfaces as a 404, while unexpected failures still become a 400.
Added two spec files covering the handlers and the service: 403 and 404 pass through unchanged, and plain errors are still reported as 400.