feat: surface approval URL when calling unapproved Actor

[raethlo]

tldr; the run Actor API returns an approvalUrl when an Actor needs full account access — we were swallowing it and only printing the bare error message.

Before

Run: Calling Actor apify/puppeteer-scraper (YJCnS9qogi9XxDgLB)

Error: This Actor requires full access to your account. You must approve its permissions before running it.

After

Handled in the same catch block as record-not-found in run-on-cloud.ts. Affects apify call, apify actors call, apify actors start, apify task run and apify tasks run.

Test plan

• Manually triggered against apify/puppeteer-scraper, approval URL surfaces correctly
• Add a vitest case for the full-permission-actor-not-approved branch

[raethlo]

@vladfrangu I am not sure about the tests, Claude generated and heavily mocked 🤷🏻 there don't seem to be any other lib tests, so I think we could just remove them