fix(api): read the error code before the status

A read-failure primitive decided from the status alone, so a 401 from a
step-up or re-proof gate would have read as an ended session and sent
the reader to sign-in. The code now decides first and the status is the
fallback for codes it does not know.

The two invitation routes answer an unknown name or e-mail with
sharing.invite.no_account. Both have a second 404 with a different next
step, and since every error now carries a code the clients match on it
instead of on the status. The status defaults move into a module the
client can import, and the contract text no longer says these arms
carry no code.

src/lib/__tests__/api-handler-error-request-id.test.ts

@@ -24,9 +24,9 @@ import { apiHandler, HttpError } from "@/lib/api-handler";
 import {
   apiError,
   apiSuccess,
-  defaultErrorCodeForStatus,
   withErrorEnvelopeDefaults,
 } from "@/lib/api-response";
+import { defaultErrorCodeForStatus } from "@/lib/api/default-error-codes";
 
 const INCOMING = "3f9a2c1b-0000-4000-8000-000000000001";