feat(api): error + validate + pagination plumbing

Add lib/api/{errors,validate,pagination,index}.js: typed ApiError
subclasses, errorMiddleware, zod-backed validate(), parsePagination
with caps, and a mountApi() that owns /api routing + 404 + error tail.
server.js delegates /api to mountApi and drops the inline /api/spaces
smoke (returns in Task 2).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

tests/api/helpers.js

@@ -0,0 +1,14 @@
+import { createApp } from '../../server.js';
+import { resetDb } from '../helpers/db.js';
+import { migrateUp } from '../../lib/db/migrate.js';
+
+const OWNER_TOKEN = 'test-token';
+
+export async function setup() {
+  await resetDb();
+  await migrateUp();
+  process.env.OWNER_TOKEN = OWNER_TOKEN;
+  const app = createApp();
+  const ownerHeaders = { Authorization: `Bearer ${OWNER_TOKEN}` };
+  return { app, ownerHeaders, OWNER_TOKEN };
+}