feat(api): error + validate + pagination plumbing

Add lib/api/{errors,validate,pagination,index}.js: typed ApiError
subclasses, errorMiddleware, zod-backed validate(), parsePagination
with caps, and a mountApi() that owns /api routing + 404 + error tail.
server.js delegates /api to mountApi and drops the inline /api/spaces
smoke (returns in Task 2).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

lib/api/validate.js

@@ -0,0 +1,15 @@
+import { ValidationError } from './errors.js';
+
+export function validate({ body, params, query } = {}) {
+  return (req, _res, next) => {
+    try {
+      if (body)   req.body   = body.parse(req.body);
+      if (params) req.params = params.parse(req.params);
+      if (query)  req.validatedQuery = query.parse(req.query);
+      next();
+    } catch (e) {
+      if (e?.issues) return next(new ValidationError('validation failed', e.issues));
+      next(e);
+    }
+  };
+}