Function present

Map an AppError to a PresentationPolicy.

Full AC-9 mapping:

• Cancelled → silent (never shown)
• Network (retryable) → panel + toast
• Internal → panel + toast (with trace ID)
• RateLimited → panel + toast (with retry-after countdown)
• Auth / AccessDenied in background context → panel only
• Auth / AccessDenied in user-initiated context → panel + inline
• Validation (user-initiated) → inline only
• Locked → panel + inline (always blocks the active surface)
• NotFound → panel + inline
• Conflict → panel + toast (optimistic concurrency)
• Unsupported → panel + toast
• ProviderSpecific → panel + toast

OCP: adding a new error variant = adding one case here. No other changes needed.