Standardize the error response shape (`error` vs `message`)

[Bccorb]

Context

Surfaced during a usability survey.

Error responses are inconsistent: some endpoints return { "error": "..." }, others { "message": "..." }, and ErrorSchema (src/schemas/generic.responses.ts) makes both optional, so the shape is ambiguous for consumers. Example: /login returns { error: "Not Allowed" } while other handlers use message.

Contract warning (ripple protocol)

This is contract-affecting. Per CLAUDE.md, the SDKs branch on response fields:

• seamless-auth-react parses message from responses.
• seamless-auth-server unpacks response shapes directly.

So this cannot be a unilateral change here. It needs the ripple protocol: survey seamless-auth-react and seamless-auth-server for break sites, then a coordinated change (likely a @seamless-auth/types bump).

Suggested work

• Choose one canonical error shape (recommend { error: string, message?: string } or vice versa) and apply it across all handlers + ErrorSchema.
• Survey the two SDKs for parse sites; coordinate the change and version bump.
• Add a response-schema coverage assertion so new routes conform.

Acceptance

• One documented error shape, enforced by schema, with the SDK impact assessed and coordinated.