feat(api): error + validate + pagination plumbing

Add lib/api/{errors,validate,pagination,index}.js: typed ApiError
subclasses, errorMiddleware, zod-backed validate(), parsePagination
with caps, and a mountApi() that owns /api routing + 404 + error tail.
server.js delegates /api to mountApi and drops the inline /api/spaces
smoke (returns in Task 2).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

lib/api/index.js

@@ -0,0 +1,16 @@
+import { Router } from 'express';
+import { ownerOnly } from '../auth/owner.js';
+import { errorMiddleware, NotFoundError } from './errors.js';
+
+export function mountApi(app) {
+  const api = Router();
+  api.use(ownerOnly);
+
+  // route modules registered here as Plan 2 progresses
+
+  api.use((_req, _res, next) => next(new NotFoundError('route not found')));
+
+  api.use(errorMiddleware);
+  app.use('/api', api);
+  return api;
+}