BUG: Institution status IDP rejection is logged as an unhandled exception

**Describe the Bug**

An institution status request from a client using an unexpected identity provider returns 403 and is emitted as an unhandled exception.

**Expected Behaviour**

The identity-provider authorization rejection is handled as an expected client response and does not generate a misleading unhandled-exception error log.

**Actual Behaviour**

`AuthorizedPartiesGuard` returns `ForbiddenException` and `AppAllExceptionsFilter` records it as unhandled.

**Log**

```text
[Nest] 18 - 09/04/2026, 5:48:18 AM LOG [AccessLoggerMiddleware] Request - GET /api/institutions/institution-user/status From [redacted] | User GUID: [redacted] | User Agent: Safari on iPhone
[Nest] 18 - 09/04/2026, 5:48:18 AM ERROR [AppAllExceptionsFilter] Unhandled exception, request path: /api/institutions/institution-user/status
{
"stack": "ForbiddenException: Client is not authorized under the expected identity provider(IDP).\n at AuthorizedPartiesGuard.canActivate (webpack://studentaid-backend/apps/api/src/auth/guards/authorized-parties.guard.ts:51:13)",
"response": { "message": "Client is not authorized under the expected identity provider(IDP)." },
"status": 403,
"message": "Client is not authorized under the expected identity provider(IDP).",
"name": "ForbiddenException"
}
```

Start with apps/api/src/auth/guards/authorized-parties.guard.ts and inspect how its ForbiddenException reaches AppAllExceptionsFilter. Trace the handling of this expected 403 response and verify that the identity-provider rejection no longer produces an unhandled-exception log while the client still receives 403.

Written by the indexing model from the issue text.