fix(api): close contract gaps found by post-merge adversarial audit

A 15-agent audit of the merged tree confirmed 9 envelope/contract bugs;
all fixed here, with live-server contract tests added:

Blockers (fresh-install quick start broken):
- session-ui.js runClaude/runShell unwrapped .data from the /api/cases/:name
  404 error envelope (which has no data key), so a not-yet-created case threw
  TypeError instead of triggering the auto-create fallback. Now '?.data ?? {}'.

Contract violations on the new stable surface:
- Unknown /api routes returned HTTP 404 with {success:true,...} (Fastify's
  default not-found payload was wrapped by the envelope hook). Added a
  setNotFoundHandler returning the standard error envelope for /api paths.
- POST /api/events/subscribe 400 body became {success:true,data:{error}};
  now createErrorResponse(INVALID_INPUT).
- POST /api/clipboard validation error lacked errorCode and shipped HTTP 200;
  now createErrorResponse(INVALID_INPUT) -> 400.
- POST /api/run catch path returned bare {success:false,sessionId,error}
  (HTTP 200, no errorCode); now OPERATION_FAILED envelope -> 422 with the
  dead session id in the message.
- DELETE tail-file/:streamId returned {success: closed}, colliding with the
  envelope discriminator; now returns {closed}.

Dead/regressed UI paths:
- Plan history modal could never open: route returned the bare history array
  under data while the frontend read data.data.history/currentVersion. Route
  now returns {history, currentVersion}; modal task count fixed to stats.total.
- Self-update error toast read j.error.message from the string-typed envelope
  error, always falling back to the generic message; now reads the string.

Cleanup:
- Removed the stale QuickStartResponse type (unreferenced; documented the
  pre-envelope shape and invited success-key collisions).

Tests: new test/http-contract.test.ts boots a real WebServer (port 3168) and
pins the envelope, /api/v1 alias, error statuses, and the /api 404 shape —
the route-test harness does not install the server-level hook, so these need
the live server. Updated file-routes/plan-routes/scheduled-runs tests to the
fixed shapes.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

test/routes/file-routes.test.ts

@@ -363,11 +363,11 @@ describe('file-routes', () => {
       });
       expect(res.statusCode).toBe(200);
       const body = JSON.parse(res.body);
-      expect(body.success).toBe(true);
+      expect(body.closed).toBe(true);
       expect(mockedFileStreamManager.closeStream).toHaveBeenCalledWith('stream-1');
     });
 
-    it('returns false for unknown stream', async () => {
+    it('returns closed: false for unknown stream', async () => {
       mockedFileStreamManager.closeStream.mockReturnValue(false);
 
       const res = await harness.app.inject({
@@ -376,7 +376,7 @@ describe('file-routes', () => {
       });
       expect(res.statusCode).toBe(200);
       const body = JSON.parse(res.body);
-      expect(body.success).toBe(false);
+      expect(body.closed).toBe(false);
     });
   });
 

test/routes/plan-routes.test.ts

@@ -235,13 +235,14 @@ describe('plan-routes', () => {
       expect(body.error).toContain('Ralph tracker');
     });
 
-    it('returns plan version history', async () => {
+    it('returns plan version history with the current version', async () => {
       const mockHistory = [
         { version: 1, timestamp: Date.now() - 60000, itemCount: 10 },
         { version: 2, timestamp: Date.now(), itemCount: 12 },
       ];
       harness.ctx._session.ralphTracker = {
         getPlanHistory: vi.fn(() => mockHistory),
+        planVersion: 2,
       } as never;
 
       const res = await harness.app.inject({
@@ -251,8 +252,9 @@ describe('plan-routes', () => {
       expect(res.statusCode).toBe(200);
       const body = JSON.parse(res.body);
       expect(body.success).toBe(true);
-      expect(body.data).toHaveLength(2);
-      expect(body.data[1].version).toBe(2);
+      expect(body.data.history).toHaveLength(2);
+      expect(body.data.history[1].version).toBe(2);
+      expect(body.data.currentVersion).toBe(2);
     });
   });