BadRequestException, UnauthorizedException, ForbiddenException - all extend DomainException. use cases throw these to signal HTTP 4xx categories; controllers translate to JsonResponse status codes (400, 401, 403).