feat: standardise the error response envelope helper (#739)

[Obiajulu-gif]

Summary

buildErrorResponse(code, message, details?) already existed in lib/utils/api-response.utils.ts with the exact requested shape — { error: { code, message, details? } }, details omitted when not provided/empty — but two things from the issue were still missing:

1. Empty string code validation. buildErrorResponse now throws InvalidErrorCode when called with an empty string code.
2. Consistent usage. Several handlers and middleware still built their own inline { success: false, ... } objects instead of calling the helper, so the envelope shape wasn't actually consistent across all endpoints yet.

Changes

• buildErrorResponse throws InvalidErrorCode for an empty code, with a new unit test alongside the existing with/without-details coverage.
• Replaced every remaining inline error-object construction with the shared helper:
  • error.middleware.ts: JWT error, TokenExpired, Prisma error, ApiError catch, oversized-payload (413), malformed-JSON (400) branches
  • body-parse-error.middleware.ts: both its 413 and 400 branches
  • ledger.controllers.ts and health.controllers.ts: catch-all 500s
  • admin.controllers.ts: the indexer-replay lock-conflict 409
  • auth.controllers.ts: the refresh-token 401s — their old lowercase code: 'invalid_token'/code: result.code strings now live in details instead, since the envelope's code field is the shared ErrorCode vocabulary
• Left mapUnknownRouteError (route-error.utils.ts) alone — it's the deliberate last-resort fallback with its own debug-mode stack/raw-error fields and already-factored tests, not an inline inconsistency to clean up.
• Left the internal (non-HTTP-response) { success: false, ... } return values in token-refresh.utils.ts and stellar-submit.utils.ts alone — they're not API response bodies.
• Updated the two affected test files (ledger.controllers.test.ts, body-parse-error.middleware.test.ts) for the new nested error shape.

Acceptance Criteria

• Envelope shape { error: { code, message } } consistent across all endpoints
• details absent when not provided
• Empty string code throws InvalidErrorCode
• All existing inline error objects replaced with the helper

Test plan

• tsc --noEmit is clean on every file this PR touches (repo has ~30 pre-existing unrelated errors elsewhere — missing Prisma models, redis nullability, etc. — none overlapping this change)
• Ran every test file covering the touched code: api-response.utils, ledger.controllers, body-parse-error.middleware, error.middleware, admin.controllers, health — 125/125 passing

Closes #739