Resolve Touchpoint

Boundary guard: this endpoint must never return a 5xx.

_resolve_touchpoint already refuses on every failure it anticipates. This exists for the ones it does not. Staging found two -- an unknown campaign and an inverted range -- and both were 500s reaching a Brain run that had already paid for classification. The specific causes are fixed; this makes the CLASS of failure impossible rather than fixing them one at a time.

Deliberately a wrapper rather than another nested try: the resolver is already at the edge of the cognitive-complexity limit, and a guard that makes the guarded function harder to read is a bad trade.

HTTPException passes through untouched -- a 404 for an unknown campaign is a deliberate answer, not an escaped error.