app: error handling: make custom Error Classes that can be `raise`d

Fixes the infamous `not_authorized` mess:
`raise UserForbiddenError` instead of `not_authorized!`
doc: dev guide: add informal spec about individual contexts aka vocabularies