[#1144] Standardize the API error envelope - #1160

Summary

• centralize public error-code and message normalization for every error-handler response
• preserve safe, field-level validation details while removing stack traces and sensitive diagnostics
• make unknown thrown values, upstream failures, and status-bearing errors JSON-safe and correlation-aware
• add contract coverage for the global handler, response wrapper, legacy JSON sends, skipped binary streams, and response validation

Behavior

• trusted application errors retain their documented public code and message
• unknown 5xx failures always return a generic message; development diagnostics are limited to safe client errors
• malformed validation details are bounded and sanitized before reaching clients
• response envelopes are validated consistently and contract violations become safe 500 envelopes

Validation

• npm test -- --runInBand src/errors/errorEnvelopePolicy.test.ts src/middleware/errorHandler.contract.test.ts src/middleware/envelope.error-contract.test.ts
• npm run typecheck (blocked by the pre-existing syntax errors in src/routes/refresh-token.test.ts:445)

Closes #1144