[codex] Harden API error contracts

[ewlarson]

Summary

• Add a shared public API error contract with errors[] payloads and request IDs.
• Add request ID middleware and make unhandled 500s public-safe instead of returning raw exception text.
• Move search, facet, and suggestion 500 responses onto the shared error envelope and document that schema in OpenAPI for those routes.
• Redact Elasticsearch query failures so public responses no longer include raw exception text, query payloads, index names, or upstream info blobs.
• Fix the WMS/WMTS distribution seed mismatch that made DB test migrations non-idempotent.

Why

This is the first focused slice of the v1.0 API contract hardening work. It gives us a central error model, safer dependency failure behavior, and request IDs for support/debug correlation without broad-breaking every legacy 4xx response shape in one pass.

Validation

• docker compose -p data-api run --rm --no-deps --pull never api bash -lc 'cd /app && uv pip install -e ./backend[dev] --system >/tmp/dev-install.log && cd /app/backend && python -m pytest tests/api/test_error_contracts.py tests/elasticsearch/test_search.py::TestElasticsearchSearch::test_search_resources_error_handling tests/services/test_mcp_service.py::TestOGMMCPService::test_search_resources_tool_surfaces_api_errors'
• docker compose -p data-api run --rm --no-deps --pull never api bash -lc 'cd /app && uv pip install -e ./backend[dev] --system >/tmp/dev-install.log && cd /app/backend && python -m ruff check app/api/errors.py app/main.py app/api/v1/endpoint_modules/search.py app/elasticsearch/search.py tests/api/test_error_contracts.py tests/api/v1/test_search_endpoints.py tests/elasticsearch/test_search.py tests/services/test_mcp_service.py'
• git diff --check

Note: the Docker services on this machine are running under compose project data-api, so validation used docker compose -p data-api ....