feat(api): establish stable HTTP contract — uniform {success,data} envelope, status codes, /api/v1

Point 1 of the v1.0 lock-in: commit to a stable HTTP API (the cleanest, fullest form).

Core (centralized):
- Every JSON /api response now uses ONE envelope via a Fastify preSerialization hook (src/web/server.ts): success -> { success:true, data:<payload> }; error -> { success:false, error, errorCode } with a conventional HTTP status. Non-JSON routes (file-raw, tail-file SSE, download, screenshots, /q redirect, WS) are skipped.
- Error-code -> HTTP status is a single source of truth (httpStatusForErrorCode in src/types/api.ts): 400/401/404/409/422/429/500. Expanded ApiErrorCode (added UNAUTHORIZED, CONFLICT, RATE_LIMITED). Errors are no longer HTTP 200.
- Versioned alias: /api/v1/* rewrites to /api/* (rewriteApiV1Url), so external clients pin to a stable surface while the bundled UI keeps using /api/*.
- Handlers stripped of manual 'success:true' (50 across 14 route files) so they return bare payloads the hook wraps uniformly; fixed the mux DELETE {success:<bool>} envelope collision (-> {killed}).

Frontend (48 call sites across 10 files):
- _apiJson() auto-unwraps { success:true, data } -> data (null on error), so most bare-shape readers are transparent. Raw-fetch sites relocate payload reads under .data; success/res.ok/error checks unchanged.

Docs: new docs/api-reference.md (envelope, status table, error codes, /api/v1, SSE); versioning-policy.md flipped — the HTTP/SSE API is now part of the stable, SemVer-covered surface.

Verification: full unit/route suite green (2680 passed) incl. ~166 updated assertions across 24 test files; typecheck/lint/format/frontend-syntax clean; a headless-chromium smoke loaded the migrated UI and drove the panels with 0 console/page errors; /api/status and /api/v1/status confirmed returning the uniform envelope live.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

test/quick-start.test.ts

@@ -47,14 +47,14 @@ describe('Quick Start API', () => {
       const data = await response.json();
 
       expect(data.success).toBe(true);
-      expect(data.sessionId).toBeDefined();
-      expect(data.caseName).toBe(testCaseName);
-      expect(data.casePath).toBe(join(CASES_DIR, testCaseName));
+      expect(data.data.sessionId).toBeDefined();
+      expect(data.data.caseName).toBe(testCaseName);
+      expect(data.data.casePath).toBe(join(CASES_DIR, testCaseName));
 
       // Verify case folder was created
-      expect(existsSync(data.casePath)).toBe(true);
-      expect(existsSync(join(data.casePath, 'CLAUDE.md'))).toBe(true);
-      expect(existsSync(join(data.casePath, 'src'))).toBe(true);
+      expect(existsSync(data.data.casePath)).toBe(true);
+      expect(existsSync(join(data.data.casePath, 'CLAUDE.md'))).toBe(true);
+      expect(existsSync(join(data.data.casePath, 'src'))).toBe(true);
     });
 
     it('should use existing case without recreating it', async () => {
@@ -74,7 +74,7 @@ describe('Quick Start API', () => {
       const data = await response.json();
 
       expect(data.success).toBe(true);
-      expect(data.caseName).toBe(testCaseName);
+      expect(data.data.caseName).toBe(testCaseName);
       // Case should exist but CLAUDE.md won't be created since case already exists
       expect(existsSync(casePath)).toBe(true);
     });
@@ -118,7 +118,7 @@ describe('Quick Start API', () => {
       const data = await response.json();
 
       expect(data.success).toBe(true);
-      expect(data.caseName).toBe(testCaseName);
+      expect(data.data.caseName).toBe(testCaseName);
     });
 
     it('should default to "testcase" when no caseName provided', async () => {
@@ -137,7 +137,7 @@ describe('Quick Start API', () => {
       const data = await response.json();
 
       expect(data.success).toBe(true);
-      expect(data.caseName).toBe('testcase');
+      expect(data.data.caseName).toBe('testcase');
     });
   });
 });
@@ -167,10 +167,10 @@ describe('Session Management', () => {
       const data = await response.json();
 
       expect(data.success).toBe(true);
-      expect(data.session).toBeDefined();
-      expect(data.session.id).toBeDefined();
-      expect(data.session.workingDir).toBe('/tmp');
-      expect(data.session.status).toBe('idle');
+      expect(data.data.session).toBeDefined();
+      expect(data.data.session.id).toBeDefined();
+      expect(data.data.session.workingDir).toBe('/tmp');
+      expect(data.data.session.status).toBe('idle');
     });
   });
 
@@ -179,7 +179,8 @@ describe('Session Management', () => {
       const response = await fetch(`${baseUrl}/api/sessions`);
       const data = await response.json();
 
-      expect(Array.isArray(data)).toBe(true);
+      expect(data.success).toBe(true);
+      expect(Array.isArray(data.data)).toBe(true);
     });
   });
 
@@ -188,12 +189,13 @@ describe('Session Management', () => {
       const response = await fetch(`${baseUrl}/api/status`);
       const data = await response.json();
 
-      expect(data).toHaveProperty('sessions');
-      expect(data).toHaveProperty('scheduledRuns');
-      expect(data).toHaveProperty('respawnStatus');
-      expect(data).toHaveProperty('timestamp');
-      expect(Array.isArray(data.sessions)).toBe(true);
-      expect(Array.isArray(data.scheduledRuns)).toBe(true);
+      expect(data.success).toBe(true);
+      expect(data.data).toHaveProperty('sessions');
+      expect(data.data).toHaveProperty('scheduledRuns');
+      expect(data.data).toHaveProperty('respawnStatus');
+      expect(data.data).toHaveProperty('timestamp');
+      expect(Array.isArray(data.data.sessions)).toBe(true);
+      expect(Array.isArray(data.data.scheduledRuns)).toBe(true);
     });
   });
 });
@@ -224,7 +226,8 @@ describe('Case Management', () => {
       const response = await fetch(`${baseUrl}/api/cases`);
       const data = await response.json();
 
-      expect(Array.isArray(data)).toBe(true);
+      expect(data.success).toBe(true);
+      expect(Array.isArray(data.data)).toBe(true);
     });
   });
 
@@ -298,9 +301,10 @@ describe('Case Management', () => {
       const response = await fetch(`${baseUrl}/api/cases/${testCaseName}`);
       const data = await response.json();
 
-      expect(data.name).toBe(testCaseName);
-      expect(data.path).toBeDefined();
-      expect(data.hasClaudeMd).toBe(true);
+      expect(data.success).toBe(true);
+      expect(data.data.name).toBe(testCaseName);
+      expect(data.data.path).toBeDefined();
+      expect(data.data.hasClaudeMd).toBe(true);
     });
 
     it('should return error for non-existent case', async () => {