feat(api): establish stable HTTP contract — uniform {success,data} envelope, status codes, /api/v1

Point 1 of the v1.0 lock-in: commit to a stable HTTP API (the cleanest, fullest form).

Core (centralized):
- Every JSON /api response now uses ONE envelope via a Fastify preSerialization hook (src/web/server.ts): success -> { success:true, data:<payload> }; error -> { success:false, error, errorCode } with a conventional HTTP status. Non-JSON routes (file-raw, tail-file SSE, download, screenshots, /q redirect, WS) are skipped.
- Error-code -> HTTP status is a single source of truth (httpStatusForErrorCode in src/types/api.ts): 400/401/404/409/422/429/500. Expanded ApiErrorCode (added UNAUTHORIZED, CONFLICT, RATE_LIMITED). Errors are no longer HTTP 200.
- Versioned alias: /api/v1/* rewrites to /api/* (rewriteApiV1Url), so external clients pin to a stable surface while the bundled UI keeps using /api/*.
- Handlers stripped of manual 'success:true' (50 across 14 route files) so they return bare payloads the hook wraps uniformly; fixed the mux DELETE {success:<bool>} envelope collision (-> {killed}).

Frontend (48 call sites across 10 files):
- _apiJson() auto-unwraps { success:true, data } -> data (null on error), so most bare-shape readers are transparent. Raw-fetch sites relocate payload reads under .data; success/res.ok/error checks unchanged.

Docs: new docs/api-reference.md (envelope, status table, error codes, /api/v1, SSE); versioning-policy.md flipped — the HTTP/SSE API is now part of the stable, SemVer-covered surface.

Verification: full unit/route suite green (2680 passed) incl. ~166 updated assertions across 24 test files; typecheck/lint/format/frontend-syntax clean; a headless-chromium smoke loaded the migrated UI and drove the panels with 0 console/page errors; /api/status and /api/v1/status confirmed returning the uniform envelope live.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

test/edge-cases.test.ts

@@ -190,7 +190,7 @@ describe('Edge Cases and Error Handling', () => {
 
       // Should succeed with valid characters, even if long
       if (data.success) {
-        createdCases.push(longName);
+        createdCases.push(data.data.caseName);
       }
       // Either succeeds or fails gracefully
       expect(data).toHaveProperty('success');
@@ -202,8 +202,8 @@ describe('Edge Cases and Error Handling', () => {
       const response = await fetch(`${baseUrl}/api/sessions/non-existent/respawn`);
       const data = await response.json();
 
-      expect(data.enabled).toBe(false);
-      expect(data.status).toBeNull();
+      expect(data.data.enabled).toBe(false);
+      expect(data.data.status).toBeNull();
     });
 
     it('should handle starting respawn on non-existent session', async () => {
@@ -287,17 +287,17 @@ describe('Concurrent Session Handling', () => {
     // All should succeed
     for (const result of results) {
       expect(result.success).toBe(true);
-      expect(result.session.id).toBeDefined();
+      expect(result.data.session.id).toBeDefined();
     }
 
     // Verify sessions are listed
     const listRes = await fetch(`${baseUrl}/api/sessions`);
     const sessions = await listRes.json();
-    expect(sessions.length).toBeGreaterThanOrEqual(5);
+    expect(sessions.data.length).toBeGreaterThanOrEqual(5);
 
     // Clean up - delete all created sessions
     for (const result of results) {
-      await fetch(`${baseUrl}/api/sessions/${result.session.id}`, {
+      await fetch(`${baseUrl}/api/sessions/${result.data.session.id}`, {
         method: 'DELETE',
       });
     }
@@ -317,7 +317,7 @@ describe('Concurrent Session Handling', () => {
       expect(createData.success).toBe(true);
 
       // Delete immediately
-      const deleteRes = await fetch(`${baseUrl}/api/sessions/${createData.session.id}`, {
+      const deleteRes = await fetch(`${baseUrl}/api/sessions/${createData.data.session.id}`, {
         method: 'DELETE',
       });
       const deleteData = await deleteRes.json();
@@ -341,8 +341,8 @@ describe('Concurrent Session Handling', () => {
 
     for (const result of results) {
       expect(result.success).toBe(true);
-      if (result.caseName) {
-        createdCases.push(result.caseName);
+      if (result.data.caseName) {
+        createdCases.push(result.data.caseName);
       }
     }