feat(api): reject deployment requests

[ctxswitch]

Parent

Related to #1

What to build

Implement rejection for Deployment Requests so reviewers can stop requests that should not proceed.

Acceptance criteria

• POST /deployments/{id}/reject transitions pending_approval requests to rejected.
• Rejection requires a non-empty note.
• rejected is terminal.
• Invalid rejection attempts return conflict or validation errors as appropriate.
• Tests cover successful rejection, missing rejection note, terminal rejection behavior, and invalid rejection transitions.

Blocked by

• feat(domain): enforce lifecycle transition rules #10