feat(backend): RFC 7807 problem+json error envelope across all routes

[RajeshRk18]

Closes #635

Every API error now serialises as an RFC 7807 application/problem+json document, built from the existing error-code registry (shared/errorCodes.js):

{
  "type": "https://github.com/FinChippay/Finchippay-Solution/blob/main/docs/error-codes.md#auth_forbidden",
  "title": "You do not have permission to access this resource.",
  "status": 403,
  "detail": "You do not have permission to access this resource.",
  "instance": "/api/accounts/x",
  "code": "AUTH_FORBIDDEN",
  "correlationId": "…",
  "error": { "code": "AUTH_FORBIDDEN", "message": "…", "correlationId": "…" }
}

• type derives from the code alone (docs/error-codes.md anchor, code lowercased); title is the stable registry message; detail is the per-occurrence message; instance is the request path with the query string dropped.
• correlationId, details, and the full pre-7807 error object are kept as RFC-permitted extension members, so existing frontend/SDK consumers keep working unchanged.

Changes:

• shared/errorCodes.js: formatProblemResponse, problemTypeUri, PROBLEM_CONTENT_TYPE; registry entries untouched (npm run docs:errors:check passes).
• New backend/src/middleware/errorHandler.js: body-parse failures, 404, and the terminal handler moved out of server.js, all emitting the envelope. Unexpected errors render SRV_INTERNAL with an allowlist for safe detail messages — raw internals and stack traces never leak (the old details.originalMessage echo of raw messages is removed).
• sendError/buildProblemResponse set the media type and instance; zodErrorHandler/validate() and both express-rate-limit limiters (custom handler, RateLimit-*/Retry-After headers and breach metrics preserved) emit the envelope; turretsServer.js shares the same terminal handler.
• 22 route/controller/middleware files migrated off ad-hoc res.status().json({...}) bodies onto sendError/createError, statuses preserved. Protocol-mandated shapes left intact: health probes, parsePayment's documented chat-UI contract, SEP-24/38 pass-throughs.
• Tests: new backend/__tests__/errorEnvelope.test.js (13 tests: 400 validation, 401, 403, 404, 400 bad JSON, 413, 429, 500 sanitisation, createError); 13 existing assertions updated to the new shape.

Verification: envelope + error-code suites pass (83 tests); full unit run matches the main baseline exactly (the 29 failing suites on main come from a pre-existing @stellar/stellar-sdk ESM/Jest issue, unrelated); backend lint reports only the pre-existing error in src/services/notificationService.js.

[github-actions]

🤖 Greptile AI Code Review

Greptile will automatically review this PR (32 file(s) changed).

Review gates:

• ✅ CodeQL Security Scan
• ✅ Custom rules (.greptile/config.json)
• ✅ Architecture guidelines (.greptile/rules.md)

To manually trigger a re-review, comment @greptileai on this PR.
To skip review, add the skip-review label.