Duplicate-URL save returns 500 instead of a clean 409

The stretch-goal duplicate-URL feature is the whole reason the DB has a unique constraint on url -- right now, saving a URL that already exists returns a raw 500 Internal Server Error (the generic "failed to create bookmark" body) instead of the clean 409 Conflict with the existing record that the API is documented to return. Every duplicate save looks like a server crash to the client instead of an expected, recoverable case.

isUniqueViolation checks the Postgres error code against the wrong SQLSTATE -- it's checking for foreign_key_violation (23503) instead of unique_violation (23505), so it never actually recognizes a duplicate-URL insert failure for what it is; that error falls through to the generic 500 path.

curl -s -X POST http://localhost:8081/bookmarks -H 'Content-Type: application/json'
-d '{"url":"https://go.dev","title":"The Go Programming Language"}'

first call: 201

curl -s -X POST http://localhost:8081/bookmarks -H 'Content-Type: application/json'
-d '{"url":"https://go.dev","title":"Duplicate attempt"}'

23503 and 23505 are both common Postgres constraint-violation codes and easy to confuse when copying from memory or another snippet -- this is a realistic "wrong constant" mistake that silently compiles (both are just string literals) and only shows up when the specific constraint it's supposed to detect actually fires.

Look at the SQLSTATE code isUniqueViolation compares against, and check it against what a Postgres unique_violation actually is (the bookmarks migration's own comment above the unique index explains why this constraint exists in the first place).