feat(api): wrap JSON responses in envelope

Add response envelope middleware to standardize JSON responses as
`{code,data,message}` with consistent business codes across endpoints.
Update Swagger annotations and tests to reflect the new response shape.

BREAKING CHANGE: API responses are now wrapped in a response envelope; clients must read payloads from `data` and handle `code`/`message` fields.

internal/api/apikey_stats_handler_test.go

@@ -1,12 +1,12 @@
 package api
 
 import (
-	"encoding/json"
 	"math"
 	"net/http"
 	"net/http/httptest"
 	"testing"
 
+	"github.com/ez-api/ez-api/internal/middleware"
 	"github.com/ez-api/ez-api/internal/model"
 	"github.com/gin-gonic/gin"
 	"gorm.io/driver/sqlite"
@@ -45,6 +45,7 @@ func TestAdminHandler_GetAPIKeyStatsSummary(t *testing.T) {
 
 	handler := &AdminHandler{db: db}
 	r := gin.New()
+	r.Use(middleware.ResponseEnvelope())
 	r.GET("/admin/apikey-stats/summary", handler.GetAPIKeyStatsSummary)
 
 	req := httptest.NewRequest(http.MethodGet, "/admin/apikey-stats/summary", nil)
@@ -56,8 +57,9 @@ func TestAdminHandler_GetAPIKeyStatsSummary(t *testing.T) {
 	}
 
 	var resp APIKeyStatsSummaryResponse
-	if err := json.Unmarshal(rec.Body.Bytes(), &resp); err != nil {
-		t.Fatalf("decode response: %v", err)
+	env := decodeEnvelope(t, rec, &resp)
+	if env.Code != "ok" {
+		t.Fatalf("expected code=ok, got %q", env.Code)
 	}
 	if resp.TotalRequests != 15 || resp.SuccessRequests != 12 || resp.FailureRequests != 3 {
 		t.Fatalf("totals mismatch: %+v", resp)