fix(api): keep every 500 on the ADR 0031 envelope; narrow the fail-closed handler (#101, #102)

[JumpTechCode]

#101 — 500s not consistently enveloped / internal messages leaking

Two gaps:

1. Unmapped TollgateError echoed str(exc). A TollgateError subtype not in the mapping fell to the 500 fallback but still surfaced str(exc), so internal invariant strings (e.g. "idempotency replay is missing its stored response") leaked into the 500 body. Unmapped errors now use the generic fallback message; mapped errors keep echoing their controlled domain message (e.g. insufficient budget at user:u1), unchanged.
2. No catch-all. A non-TollgateError/non-datastore exception (a genuine bug) was handled by Starlette's default middleware as plain-text Internal Server Error, off the {"error": {...}} contract. A catch-all Exception handler now returns the enveloped generic 500 and logs the traceback so the defect isn't lost.

#102 — fail-closed handler on bare OSError was too broad

handle_unavailable was registered for OSError — a very broad base, so any incidental non-datastore OSError/TimeoutError on the request path became 503 enforcement_unavailable, telling the SDK the datastore is down (inviting fail-closed-with-grace) while masking a real defect. Narrowed to ConnectionError + the builtin TimeoutError plus the SQLAlchemy connectivity types (OperationalError, InterfaceError, SQLAlchemy TimeoutError). Driver-wrapped connect/DNS/timeout failures still fail closed to 503; a bare OSError now surfaces as a 500 via the catch-all.

Handler resolution is by MRO, so ConnectionRefusedError → ConnectionError handler (503), while a bare OSError → the Exception catch-all (500).

Tests

• New: an unmapped TollgateError("<internal string>") → 500 with the generic message (no leak); a ValueError → enveloped 500 (not plain text); a bare OSError → 500 internal_error (not 503).
• Unchanged and green: the datastore-connectivity → 503 cases (ConnectionRefusedError, TimeoutError, OperationalError, InterfaceError, SQLAlchemy TimeoutError) and the full domain-error mapping.

Local gate: ruff, mypy --strict, import-linter, full unit suite (492), API-http integration — all green.

Closes #101, #102.