fix(api): give the shared write ceiling a code a client can branch on

The eleven single-record writes answered their shared 429 with prose and
nothing else, while the envelope's own description tells a client to
branch on `meta.errorCode`. On `POST /api/medications/[id]/intake` and
`POST /api/cycle/day-logs` a second, narrower bucket can answer 429 as
well, so the presence of the rate-limit headers was the only thing
telling the two refusals apart.

All eleven now carry `record_write.rate_limited`, the catalogue lists
it, the published 429 names it, and the contract test fails if a site
stops emitting it or the sentence stops publishing it.

The same description now states what a client could not predict from
"300 requests per 60 seconds": refused requests count too, because the
check runs before the body is read.

src/app/api/allergies/route.ts

@@ -93,7 +93,9 @@ async function postAllergy(request: NextRequest): Promise<Response> {
   // client hits were not.
   const writeRl = await checkRecordWriteRateLimit(actor.id);
   if (!writeRl.allowed) {
-    return apiError("Too many writes, try again later", 429);
+    return apiError("Too many writes, try again later", 429, {
+      errorCode: "record_write.rate_limited",
+    });
   }
 
   const { data: rawBody, error: jsonError } = await safeJson(request, {

src/app/api/biomarkers/route.ts

@@ -103,7 +103,9 @@ async function postBiomarker(request: NextRequest) {
   // client hits were not.
   const writeRl = await checkRecordWriteRateLimit(actor.id);
   if (!writeRl.allowed) {
-    return apiError("Too many writes, try again later", 429);
+    return apiError("Too many writes, try again later", 429, {
+      errorCode: "record_write.rate_limited",
+    });
   }
 
   const { data: body, error: jsonError } = await safeJson(request, {

src/app/api/custom-metrics/[id]/entries/route.ts

@@ -112,7 +112,9 @@ async function postCustomMetricEntry(
   // client hits were not.
   const writeRl = await checkRecordWriteRateLimit(user.id);
   if (!writeRl.allowed) {
-    return apiError("Too many writes, try again later", 429);
+    return apiError("Too many writes, try again later", 429, {
+      errorCode: "record_write.rate_limited",
+    });
   }
   const { id } = await params;
 

src/app/api/cycle/day-logs/route.ts

@@ -105,7 +105,9 @@ async function postDayLog(request: NextRequest): Promise<Response> {
   // client hits were not.
   const writeRl = await checkRecordWriteRateLimit(actor.id);
   if (!writeRl.allowed) {
-    return apiError("Too many writes, try again later", 429);
+    return apiError("Too many writes, try again later", 429, {
+      errorCode: "record_write.rate_limited",
+    });
   }
 
   const { data: rawBody, error: jsonError } = await safeJson(request, {

src/app/api/encounters/route.ts

@@ -162,7 +162,9 @@ async function postEncounter(request: NextRequest): Promise<Response> {
   // client hits were not.
   const writeRl = await checkRecordWriteRateLimit(actor.id);
   if (!writeRl.allowed) {
-    return apiError("Too many writes, try again later", 429);
+    return apiError("Too many writes, try again later", 429, {
+      errorCode: "record_write.rate_limited",
+    });
   }
 
   const { data: rawBody, error: jsonError } = await safeJson(request, {

src/app/api/labs/route.ts

@@ -156,7 +156,9 @@ async function postLabResult(request: NextRequest) {
   // client hits were not.
   const writeRl = await checkRecordWriteRateLimit(actor.id);
   if (!writeRl.allowed) {
-    return apiError("Too many writes, try again later", 429);
+    return apiError("Too many writes, try again later", 429, {
+      errorCode: "record_write.rate_limited",
+    });
   }
 
   const { data: body, error: jsonError } = await safeJson(request, {

src/app/api/measurements/route.ts

@@ -807,7 +807,9 @@ async function postMeasurement(request: NextRequest) {
   // client hits were not.
   const writeRl = await checkRecordWriteRateLimit(auth.actor.id);
   if (!writeRl.allowed) {
-    return apiError("Too many writes, try again later", 429);
+    return apiError("Too many writes, try again later", 429, {
+      errorCode: "record_write.rate_limited",
+    });
   }
 
   const { data: body, error: jsonError } = await safeJson(request, {

src/app/api/medications/[id]/intake/route.ts

@@ -64,7 +64,9 @@ async function postIntake(request: NextRequest, { params }: RouteParams) {
   // client hits were not.
   const writeRl = await checkRecordWriteRateLimit(actor.id);
   if (!writeRl.allowed) {
-    return apiError("Too many writes, try again later", 429);
+    return apiError("Too many writes, try again later", 429, {
+      errorCode: "record_write.rate_limited",
+    });
   }
 
   // v1.36.1 follow-up — the sibling route `POST /api/medications/intake`

src/app/api/medications/intake/route.ts

@@ -209,7 +209,9 @@ export const POST = apiHandler(async (request: NextRequest) => {
   // client hits were not.
   const writeRl = await checkRecordWriteRateLimit(actor.id);
   if (!writeRl.allowed) {
-    return apiError("Too many writes, try again later", 429);
+    return apiError("Too many writes, try again later", 429, {
+      errorCode: "record_write.rate_limited",
+    });
   }
 
   const { data: body, error } = await safeJson(request, {

src/app/api/mood-entries/route.ts

@@ -111,7 +111,9 @@ async function postMoodEntry(request: NextRequest) {
   // client hits were not.
   const writeRl = await checkRecordWriteRateLimit(actor.id);
   if (!writeRl.allowed) {
-    return apiError("Too many writes, try again later", 429);
+    return apiError("Too many writes, try again later", 429, {
+      errorCode: "record_write.rate_limited",
+    });
   }
 
   const { data: body, error: jsonError } = await safeJson(request, {

src/app/api/vaccinations/route.ts

@@ -120,7 +120,9 @@ async function postVaccination(request: NextRequest): Promise<Response> {
   // client hits were not.
   const writeRl = await checkRecordWriteRateLimit(actor.id);
   if (!writeRl.allowed) {
-    return apiError("Too many writes, try again later", 429);
+    return apiError("Too many writes, try again later", 429, {
+      errorCode: "record_write.rate_limited",
+    });
   }
 
   const { data: rawBody, error: jsonError } = await safeJson(request, {