feat(api): wrap JSON responses in envelope

Add response envelope middleware to standardize JSON responses as
`{code,data,message}` with consistent business codes across endpoints.
Update Swagger annotations and tests to reflect the new response shape.

BREAKING CHANGE: API responses are now wrapped in a response envelope; clients must read payloads from `data` and handle `code`/`message` fields.

internal/api/response_test.go

@@ -0,0 +1,27 @@
+package api
+
+import (
+	"encoding/json"
+	"net/http/httptest"
+	"testing"
+)
+
+type testEnvelope struct {
+	Code    string          `json:"code"`
+	Data    json.RawMessage `json:"data"`
+	Message string          `json:"message"`
+}
+
+func decodeEnvelope(t *testing.T, rr *httptest.ResponseRecorder, out any) testEnvelope {
+	t.Helper()
+	var env testEnvelope
+	if err := json.Unmarshal(rr.Body.Bytes(), &env); err != nil {
+		t.Fatalf("decode envelope: %v", err)
+	}
+	if out != nil {
+		if err := json.Unmarshal(env.Data, out); err != nil {
+			t.Fatalf("decode envelope data: %v", err)
+		}
+	}
+	return env
+}