Typed errors and recovery

Every failure includes X-Weirgate-Error-Type, X-Weirgate-Request-Id, and Weirgate-Api-Version. Branch on the error type, never on message text. Preserve the request ID in support output while excluding credentials and content.

Common recovery classes are validation (invalid_request), authentication and scope (invalid_token, insufficient_scope), missing resources, stale proposals, provider or policy blocks, and internal failures. The CLI maps these classes to stable exit codes so scripts can retry, request human approval, or stop safely.