The OpenAPI Error component schema declared an `error: string` field
that no controller and no middleware ever emits — the project's
no-leak policy (pinned by tests/unit/controller-error-shape.test.js)
explicitly forbids echoing raw error detail back to the client.
Conversely the global error handler in
`app/middleware/error-handler.js` does emit `requestId` when the
request reached the request-id middleware (and every server-internal
500 response body carries it for log correlation), but the schema
never named the field.

Net effect: SDK code-gen consuming the spec built client types with
a phantom `error` field while missing the real `requestId` field —
both wrong directions of drift at once.

Replace the bogus `error` property with the real `requestId` one,
keep `message` as the only required field, and pin the new shape
with a test in tests/api/openapi.test.js.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>