refactor(openapi): derive the http code family from the status table

The catalogue listed the status defaults a second time by hand. It now
reads them from DEFAULT_ERROR_CODES, the table the handler applies.

src/app/api/insights/targets/__tests__/route.test.ts

@@ -322,8 +322,8 @@ describe("GET /api/insights/targets — mood-rollup tier swap", () => {
   });
 
   it("reads latest-ever-per-type one index probe per type, floored at one year", async () => {
-    // Audit High finding 3 established the 365-day floor. The read is the
-    // shared `readLatestEver`: driven from the type list, one LIMIT 1 probe
+    // The read is floored at 365 days. It is the shared `readLatestEver`:
+    // driven from the type list, one LIMIT 1 probe
     // per type, so a dense type never sorts a year of raw rows to keep one.
     await callGet(makeReq());
 

src/lib/openapi/error-codes.ts

@@ -1,3 +1,5 @@
+import { DEFAULT_ERROR_CODES } from "@/lib/api-response";
+
 /**
  * Every `meta.errorCode` the API emits, grouped by the surface that emits it.
  *
@@ -211,25 +213,9 @@ export const ERROR_CODE_CATALOGUE: Readonly<Record<string, readonly string[]>> =
       "health_score_config.invalid",
       "health_score_config.too_narrow",
     ],
-    http: [
-      "http.bad_gateway",
-      "http.bad_request",
-      "http.client_error",
-      "http.conflict",
-      "http.forbidden",
-      "http.gateway_timeout",
-      "http.gone",
-      "http.internal",
-      "http.invalid",
-      "http.method_not_allowed",
-      "http.not_found",
-      "http.payload_too_large",
-      "http.rate_limited",
-      "http.server_error",
-      "http.unauthenticated",
-      "http.unavailable",
-      "http.unsupported_media_type",
-    ],
+    // The status defaults, derived from the table `apiHandler` applies so the
+    // two cannot drift apart.
+    http: [...new Set(Object.values(DEFAULT_ERROR_CODES))].sort(),
     illness: [
       "illness.day-log.invalid",
       "illness.disabled",