[GrantFox][Medium] Standardize the API error envelope

[greatest0fallt1me]

Summary

Standardize the API error envelope

Why this matters

Different routes expose inconsistent error shapes and unsafe internal details.

Scope

Define a versioned error envelope, stable public codes, correlation IDs, and OpenAPI mappings.

Acceptance criteria

• Every non-2xx response uses the envelope.
• Unknown failures are safe and correlated in logs.
• Validation errors identify fields without stack traces.
• Contract tests cover auth, validation, conflict, rate-limit, and upstream failures.

Validation

Add regression coverage for existing behavior, failure modes, authorization boundaries, and compatibility. The implementation must pass the repository CI checks.

Non-goals

• Typo-only, formatting-only, or documentation-only changes.
• Unrelated refactors or dependency upgrades.
• Weakening existing security, authorization, CI, or production safeguards.

Contributor application

Before implementation, comment with relevant experience, a 1–4 bullet approach, and an estimate for opening the first draft PR. Wait for maintainer assignment before coding.

PR requirements

Use a feature branch, include Closes #<issue-number>, check every acceptance criterion, link criteria to code/tests, explain security and failure-mode considerations, and pass CI.

Reward-readiness

This is a substantive GrantFox campaign issue. Merge and CI success do not by themselves guarantee reward eligibility; final reward-readiness is determined by campaign review.