Define a stable public validation error schema

[Johnpii1]

Description

This PR replaces the public exposure of ZodError.flatten() with a stable, application-owned validation error schema. Instead of returning library-specific error structures, validation failures are normalized into a consistent format containing only a safe field path, a stable rule code, and a human-readable message. The new schema is documented in OpenAPI and protected by contract tests to ensure long-term API stability.

Changes Made

• Replaced public ZodError.flatten() responses with normalizeValidationError in src/server/api/errors.ts.
• Added safe field path formatting to prevent exposing internal or sensitive validation details.
• Mapped Zod validation issues to stable application-defined rule codes.
• Ensured validation responses include only path, rule, and message, without echoing user input values.
• Documented ValidationErrorItem and ValidationErrorDetails in OpenAPI.
• Added contract tests to verify the public validation error schema remains stable.
• Added deterministic API log sampling helpers to reduce routine success-log noise while preserving security-related and unexpected error logs.

Testing

• ✅ Ran targeted unit tests:
  • tests/unit/api/errors.contract.test.ts
  • tests/unit/api/logging.test.ts
  • tests/unit/api/postage-quote-endpoint-validation.test.ts
• ✅ Ran the full unit test suite — 756 tests passed.
• ✅ npm run lint completed successfully.
• ✅ npm run build completed successfully.

closes #1476