Declare the error contract

[ExtraToast]

What to build

auth-api's published contract starts telling the truth about its failure modes, and its clients are republished with both the error schemas and the new TanStack Query artifacts.

This service is the pilot for the whole programme: it is the smallest surface (24 operations), and auth-ui is the first UI to adopt the new pipeline against it.

Acceptance criteria

• The committed spec declares error responses as application/problem+json
• The existing export drift gate still passes, so the committed spec matches live springdoc output
• oasdiff reports the change as additive, not breaking
• Republished clients are verified by inspecting the published package, not by a green run

Blocked by

• Declare ProblemDetail responses on every operation (kotlin-spring-commons tracker)