Cancel Enrichment Workflow

Cancel an in-flight DBOS enrichment workflow + refund any unsettled credits [MAIA-1468].

Returns 204 on success (idempotent on terminal states). 404 if the workflow has no reservation row (Celery-routed enrichment or unknown ID) or if the user doesn't own the workspace it belongs to. Cross-workspace access is 404 not 403 to avoid leaking workflow existence.

The _current_user Depends enforces authn; workspace authz is resolved inside the service via the request-scoped UserService (already bound to the current user via DI).