[codex] Improve REST 4xx error responses

[jillesvangurp]

Summary

• add actionable details to the REST error envelope and generated OpenAPI type
• return JSON 400 details for invalid bodies and path parameters
• return JSON 403 details for permission and ownership rule failures
• return JSON 404/405 details for missing paths and unsupported methods
• document the REST error envelope and auth-related 4xx behavior

Validation

• just bootstrap
• just generate
• go test ./internal/httpapi/handlers ./internal/auth ./cmd/hub
• just check passed generation, module, vulnerability, build/static, and unit stages; Docker-backed integration tests failed locally because rootless Docker is unavailable