feat(api): error + validate + pagination plumbing

Add lib/api/{errors,validate,pagination,index}.js: typed ApiError
subclasses, errorMiddleware, zod-backed validate(), parsePagination
with caps, and a mountApi() that owns /api routing + 404 + error tail.
server.js delegates /api to mountApi and drops the inline /api/spaces
smoke (returns in Task 2).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

lib/api/pagination.js

@@ -0,0 +1,14 @@
+import { ValidationError } from './errors.js';
+
+export function parsePagination(req, { defaultLimit = 50, max = 200 } = {}) {
+  const q = req.query || {};
+  const limit  = q.limit  === undefined ? defaultLimit : Number(q.limit);
+  const offset = q.offset === undefined ? 0            : Number(q.offset);
+  if (!Number.isFinite(limit) || limit < 1 || limit > max) {
+    throw new ValidationError(`limit must be 1..${max}`, { limit: q.limit });
+  }
+  if (!Number.isFinite(offset) || offset < 0) {
+    throw new ValidationError('offset must be >= 0', { offset: q.offset });
+  }
+  return { limit, offset };
+}