fix: return 403 join_rejected instead of 201 on rejected join

[zippy]

Fixes #12.

POST /v1/join returned 201 Created with {status: "rejected", reason} on a rejected join — and the session ID in that response was never persisted, so it was unusable anyway. Rejections now return 403 Forbidden with the standard error shape:

{ "error": { "code": "join_rejected", "message": "No eligible auth method in group" } }

Breaking change for API consumers:

• Handle join rejection as a non-2xx error instead of checking status === "rejected" on a 201 body. The bundled client now throws JoiningError with code: "join_rejected"; CLI and UI flow updated accordingly.
• Unchanged: GET /status and POST /verify can still return status: "rejected" in a 200 body — a persisted session can be rejected later (e.g. admin block). A new StatusResponse type covers this; JoinResponse.status is narrowed to "ready" | "pending".

Docs updated in JOINING_SERVICE_API.md (join rejection example/tables, /status response table, type appendix).