fix(backend): JSON error envelope for every HTTPException + strict_slashes=False

Two issues spotted by ux-frontend consuming docs/api.md against the actual
code path:

1. `flask.abort(...)` returned the Werkzeug HTML error page for 400/403/404/
   422/etc. — only the 401 paths going through `api_error()` and the
   Flask-Login `unauthorized_handler` honoured the `{error, message}`
   envelope the contract promised. The frontend's `ApiClientError.body`
   parser was forced to fall back to a raw string, and the 422 case
   could not surface Pydantic per-field errors.

   Fix: register `@app.errorhandler(HTTPException)` that serialises every
   `HTTPException` to the same JSON envelope. 422s gain a `details: [...]`
   field holding the Pydantic `errors()` list (`loc` / `msg` / `type`),
   matching the shape now documented in `docs/api.md`.

   A `_HTTP_ERROR_CODES` map maps statuses to stable snake_case codes
   (`bad_request`, `not_found`, `method_not_allowed`,
   `validation_error`, `forbidden`, `internal_error`, ...). Unknown
   statuses fall back to `http_error`.

   `description` is `cast(object, ...)` because the Werkzeug stub pins it
   to `str | None` while `flask.abort(..., description=<list>)` is the
   officially supported way to smuggle a Pydantic errors list to the
   handler.

2. `@bp.get("")` on the engagements blueprint produced `/api/v1/engagements`
   (no slash). Hitting it with a trailing slash issued a 308 redirect,
   and some browsers drop the session cookie across that hop.

   Fix: `app.url_map.strict_slashes = False`. Both forms now match the
   same handler without redirect.

5 new integration tests cover the new envelope shape (422 with details,
unknown 404, malformed-JSON 400) and the dual-slash matching. `docs/api.md`
rewritten to reflect the table of stable codes, the `details` shape, and
the no-trailing-slash convention. `CHANGELOG.md` gains a follow-up entry.

Verification: ruff check / mypy --strict / pytest tests/unit all green
(61 unit + 5 new integration).

backend/tests/integration/test_auth_engagement_e2e.py

@@ -129,3 +129,74 @@ def test_logout_without_session_returns_401(app, client) -> None:
     response = client.post("/api/v1/auth/logout")
     assert response.status_code == 401
     assert response.get_json() == {"error": "not_authenticated", "message": "no active session"}
+
+
+def test_engagements_route_accepts_both_slash_variants(app, client) -> None:
+    """strict_slashes=False: `/engagements` and `/engagements/` both match
+    the same handler — no 308 redirect that would drop the session cookie
+    on some browsers (frontend fix request)."""
+    from mimic.extensions import db  # noqa: PLC0415
+
+    with app.app_context():
+        _seed_rt_lead(db, email="dual@example.org", password="dual-slash-1")
+    client.post(
+        "/api/v1/auth/login",
+        json={"username": "dual@example.org", "password": "dual-slash-1"},
+    )
+
+    no_slash = client.get("/api/v1/engagements")
+    with_slash = client.get("/api/v1/engagements/")
+    assert no_slash.status_code == 200
+    assert with_slash.status_code == 200
+    assert no_slash.get_json() == with_slash.get_json()
+
+
+def test_engagement_create_validation_error_returns_uniform_envelope(app, client) -> None:
+    """Pydantic 422 must flow through the global handler with `details`
+    carrying the per-field error list (frontend uses it for form mapping)."""
+    from mimic.extensions import db  # noqa: PLC0415
+
+    with app.app_context():
+        _seed_rt_lead(db, email="form@example.org", password="form-secret-1")
+    client.post(
+        "/api/v1/auth/login",
+        json={"username": "form@example.org", "password": "form-secret-1"},
+    )
+
+    response = client.post("/api/v1/engagements", json={"description": "no client name"})
+    assert response.status_code == 422
+    body = response.get_json()
+    assert body["error"] == "validation_error"
+    assert body["message"] == "request failed"
+    assert isinstance(body["details"], list)
+    locs = [tuple(entry["loc"]) for entry in body["details"]]
+    assert ("client_name",) in locs
+
+
+def test_unknown_route_returns_uniform_404(app, client) -> None:
+    response = client.get("/api/v1/does-not-exist")
+    assert response.status_code == 404
+    body = response.get_json()
+    assert body["error"] == "not_found"
+    assert "message" in body
+
+
+def test_bad_json_body_returns_uniform_400(app, client) -> None:
+    from mimic.extensions import db  # noqa: PLC0415
+
+    with app.app_context():
+        _seed_rt_lead(db, email="raw@example.org", password="raw-secret-1")
+    client.post(
+        "/api/v1/auth/login",
+        json={"username": "raw@example.org", "password": "raw-secret-1"},
+    )
+
+    response = client.post(
+        "/api/v1/engagements",
+        data="not-json",
+        content_type="application/json",
+    )
+    assert response.status_code == 400
+    body = response.get_json()
+    assert body["error"] == "bad_request"
+    assert body["message"] == "JSON body required"