fix(errorpages): answer API clients with JSON instead of an HTML page

[ashishmax31]

Problem

The branded Traefik error pages from #52 are wired at the entrypoint level (charts/stackdome-agent/values.yaml), so the middleware wraps every router on web and websecure. That includes the router for the Stackdome API server, which the hub installer exposes as a StackResource (install/manifests/api-server-resource-cr.yaml, exposeToPublic: true).

Result: any 5xx from /api/v1/... reached the dashboard as text/html. axios could not parse it, so the UI lost both the error message and any structured detail.

Fix

Traefik copies the original request's headers onto the request it makes to the error-page service (custom_errors.go: utils.CopyHeaders(pageReq.Header, req.Header)), so Accept still identifies the real caller.

caller	Accept	response
browser navigation	text/html,...	branded page, unchanged
axios / API client	application/json, text/plain, */*	{"type":"Error","reason":"Internal Server Error"}
no Accept header	—	same envelope

The status code is untouched in every case, and the envelope matches the API's own Error shape (pkg/api/error_types.go in the api-server repo), so getErrorMessage() in the dashboard reads .reason with no frontend change.

The match is on an explicit text/html rather than */*: axios sends */* as its last alternative, so treating that as "browser" would reintroduce the bug for every API client. There is a test entry pinning exactly that.

What this does not do

It cannot return the backend's own error text. Traefik's errors middleware discards the caught response body before the error-page service is ever reached:

// We don't care about the contents of the response, since we want to serve the ones from the error page, so we just drop them.
— codeCatcher.Write

Recovering the real message means the middleware must not wrap API routes at all, which needs two routers per host split on Accept (a Traefik IngressRoute matching HeaderRegexp("Accept", "text/html") at higher priority, with the plain Ingress as passthrough). That makes the Traefik CRDs a runtime dependency of the operator and duplicates TLS config across two objects — deliberately left out of this PR.

Note 4xx never reaches this middleware, so validation, auth and conflict errors have always arrived intact. This only affects 5xx.

Test plan

• go build ./... — OK
• go test ./internal/... ./pkg/... ./cmd/... — 16/16 packages pass
• gofmt, go vet clean
• New DescribeTable in internal/errorpages/server_test.go covers browser / axios / no-header; existing page specs now assert Accept: text/html explicitly

Deploy note: the installer pins defaultChartVersion, so a chart version bump is needed for a VPS install to pick this up.