feat(api): error + validate + pagination plumbing

Add lib/api/{errors,validate,pagination,index}.js: typed ApiError
subclasses, errorMiddleware, zod-backed validate(), parsePagination
with caps, and a mountApi() that owns /api routing + 404 + error tail.
server.js delegates /api to mountApi and drops the inline /api/spaces
smoke (returns in Task 2).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

server.js

@@ -1,9 +1,8 @@
 import 'dotenv/config';
 import express from 'express';
 import { pool } from './lib/db/pool.js';
-import { ownerOnly } from './lib/auth/owner.js';
 import { log } from './lib/log.js';
-import * as spaces from './lib/db/repos/spaces.js';
+import { mountApi } from './lib/api/index.js';
 
 const VERSION = '2.0.0-alpha.1';
 
@@ -22,11 +21,7 @@ export function createApp() {
     res.json({ ok: true, db_ok, version: VERSION });
   });
 
-  app.use('/api', ownerOnly);
-
-  app.get('/api/spaces', async (_req, res) => {
-    res.json(await spaces.list());
-  });
+  mountApi(app);
 
   app.use((_req, res) => res.status(404).json({ error: { code: 'not_found' } }));