User Story

As an API consumer, I want errors returned as standardized Problem Details, so that failures can be handled consistently across game services.

Acceptance Criteria

Error responses use application/problem+json.
Responses require type, title, and status and optionally include detail, instance, and extensions.
Invalid Velocity payloads include machine-readable Zod issues under extensions.issues.
Missing credentials, expired requests, replays, unsupported media, unsupported methods, unknown routes, and service failures have stable urn:error:* types.
Unexpected application-owned Velocity errors are converted to safe 503 problems without internal details.
A normal whitelist denial remains a successful 200 authorization decision.
Browser form redirects remain accessible HTML flows and OAuth protocol responses remain owned by NextAuth.