fix(security): centralize WhatsApp outbound auth and return 403 tool auth errors

src/agents/tools/common.ts

@@ -24,7 +24,7 @@ export type ActionGate<T extends Record<string, boolean | undefined>> = (
 export const OWNER_ONLY_TOOL_ERROR = "Tool restricted to owner senders.";
 
 export class ToolInputError extends Error {
-  readonly status = 400;
+  readonly status: number = 400;
 
   constructor(message: string) {
     super(message);
@@ -32,6 +32,15 @@ export class ToolInputError extends Error {
   }
 }
 
+export class ToolAuthorizationError extends ToolInputError {
+  override readonly status = 403;
+
+  constructor(message: string) {
+    super(message);
+    this.name = "ToolAuthorizationError";
+  }
+}
+
 export function createActionGate<T extends Record<string, boolean | undefined>>(
   actions: T | undefined,
 ): ActionGate<T> {