Move the API error classes into a leaf module

api-handler imports the record-session fence and the fence threw
RecordSessionChangedError / SharingAccessDeniedError imported back from
api-handler — the one real import cycle in the tree, working only by
evaluation-order luck. HttpError, the SharingAuthError family and
StepUpRequiredError now live in api-errors.ts (importing nothing but
the fence contract), api-handler re-exports the identical class objects
so no importer moves, and the fence imports the leaf. A guard pins both
the identity and the leaf structure.

src/lib/sharing/record-session-fence.ts

@@ -51,11 +51,15 @@ import {
   recordSessionFenceVerdict,
   type AssertedRecordContext,
 } from "@/lib/sharing/record-session-fence-contract";
+// Runtime error classes come from the LEAF module — importing them from
+// api-handler recreated the import cycle this split removed. The
+// `AuthContext` type import stays on api-handler: type-only, erased at
+// runtime, no cycle.
 import {
   RecordSessionChangedError,
   SharingAccessDeniedError,
-  type AuthContext,
-} from "@/lib/api-handler";
+} from "@/lib/api-errors";
+import type { AuthContext } from "@/lib/api-handler";
 import { annotate, getEvent } from "@/lib/logging/context";
 
 /**