Migrate API errors to error codes, domain by domain

Follow-up to "API error codes: envelope, status fallback and guardrails" — blocked until that one ships, since it provides AppException, the shared registry and the web-side resolver.

Volume work, spreadable, no urgency: the HTTP-status fallback introduced by the infra ticket already renders every un-migrated throw cleanly. This ticket is about replacing generic fallbacks with messages that actually say something useful.

Inventory

193 throw new *Exception across 54 files, 74 distinct messages.

Suggested order

1. auth / MFA — the ForbiddenException("MFA_REQUIRED") currently string-sniffed by the web app becomes the first real consumer of the code system, which kills that hack. Login, register, refresh, password reset and email verification are also the paths a confused user hits most.
2. library / import — highest-traffic flows, and the import wizard has its own error surface (ImportWizard.svelte) that already tries to render API messages verbatim.
3. catalog / providers — the 7 BadGateway + 4 ServiceUnavailable come from TMDB / IGDB / AniList / Open Library / MusicBrainz. They deserve dedicated codes: "the catalogue is temporarily unavailable, try again in a moment" is not the same thing as a Loomkeep failure, and it avoids bug reports about outages that aren't ours.
4. social / reviews / comments / reports / lists / admin — the tail.

Also in scope

• Remove the 4 hardcoded French messages currently living API-side ("Item introuvable", "Cet épisode n'est pas encore sorti", "Image trop volumineuse", "Connexion à Simkl impossible.") — they're the existing leak the whole rework is meant to close.
• Swagger: a decorator documenting the possible error codes per endpoint, useful for self-hosters scripting the API.

Each domain is independently shippable and independently reviewable.