feat: surface approval URL when calling unapproved Actor (#1111)

tldr; the run Actor API returns an `approvalUrl` when an Actor needs
full account access — we were swallowing it and only printing the bare
error message.

  ## Before
  Run: Calling Actor apify/puppeteer-scraper (YJCnS9qogi9XxDgLB)

Error: This Actor requires full access to your account. You must approve
its permissions before running it.

  ## After
<img width="912" height="113" alt="image"
src="https://github.com/user-attachments/assets/c9d4376f-a0dd-4746-8842-7f72eabcb2ae"
/>


Handled in the same `catch` block as `record-not-found` in
`run-on-cloud.ts`. Affects `apify call`, `apify actors call`, `apify
actors start`, `apify task run` and `apify tasks run`.

  ## Test plan
- [x] Manually triggered against `apify/puppeteer-scraper`, approval URL
surfaces correctly
- [ ] Add a vitest case for the `full-permission-actor-not-approved`
branch