Run `#error_handler` blocks on served applications.

Before this change, only the top-level run application had an opportunity to run its error handler.  A served application which defined one would never see it called.  Lame.

We do a few things:
* dispatchers are evaluated in the runner context, not the execution context.
* `Application#handlers` has become `#handlers_with_error` and yields `[handler, error_handler]` block pairs.  This way each handler appears with the error handler (if any) of its native application.
* The logic of running a handler has been extracted to `Runner#invoke_handler`, which is now error-handler aware.

This way each handler sees at most one paired error handler, the one from its defining application.  We attempt no nesting/stacking of error handlers.