feat(api): align response envelope schema

Switch response envelope business code to numeric and make message
consistently present. Add trace_id and optional details, and remove the
duplicate DTO envelope definition. Improve middleware path exclusion
handling and add a time-based trace ID fallback if crypto RNG fails.

BREAKING CHANGE: response envelope `code` is now `int` (was `string`) and
`message` semantics/defaults changed; clients must update parsing.

internal/middleware/response_envelope.go

@@ -5,8 +5,10 @@ import (
 	"crypto/rand"
 	"encoding/hex"
 	"encoding/json"
+	"fmt"
 	"net/http"
 	"strings"
+	"time"
 
 	"github.com/gin-gonic/gin"
 )
@@ -227,6 +229,12 @@ func ResponseEnvelope() gin.HandlerFunc {
 }
 
 func isExcludedPath(path string) bool {
+	if path == "" {
+		return false
+	}
+	for len(path) > 1 && strings.HasSuffix(path, "/") {
+		path = strings.TrimSuffix(path, "/")
+	}
 	if excludedPaths[path] {
 		return true
 	}
@@ -298,7 +306,9 @@ func getTraceID(c *gin.Context) string {
 
 func generateTraceID() string {
 	b := make([]byte, 16)
-	_, _ = rand.Read(b)
+	if _, err := rand.Read(b); err != nil {
+		return fmt.Sprintf("%032x", time.Now().UnixNano())
+	}
 	return hex.EncodeToString(b)
 }