Run `#error_handler` blocks on served applications.

Before this change, only the top-level run application had an
opportunity to run its error handler.  A served application which
defined one would never see it called.  Lame.

We do a few things:
* dispatchers are evaluated in the runner context, not the execution
  context.
* `Application#handlers` has become `#handlers_with_error` and yields
  `[handler, error_handler]` block pairs.  This way each handler
  appears with the error handler (if any) of its native application.
* The logic of running a handler has been extracted to
  `Runner#invoke_handler`, which is now error-handler aware.

This way each handler sees at most one paired error handler, the one
from its defining application.  We attempt no nesting/stacking of
error handlers.