chore(api): p1a final-review hygiene items

- contracts: add NOT_FOUND error code (framework-level 404 for unknown
  routes); Error enum + regen committed
- api: 404 default mapping in AllExceptionsFilter now NOT_FOUND (was
  ALBUM_NOT_FOUND); business 404s unchanged via explicit ApiException codes
- api: extract configureApp (prefix/CORS/x-powered-by) shared by main-cn
  bootstrap and e2e; disable x-powered-by, asserted in e2e
- api: move parseCursor/parseLimit (+page-size bounds) from
  albums.controller to shared/pagination; members/uploads/public re-pointed
- infra: bind compose published ports to 127.0.0.1 (mysql/redis/minio);
  .env.example endpoints follow suit
- e2e: unknown-route 404 NOT_FOUND + x-powered-by absent cases added
  (api e2e 120 -> 122)

Co-Authored-By: Claude Code <noreply@anthropic.com>

.env.example

@@ -1,6 +1,6 @@
-DATABASE_URL_CN=mysql://root:root@localhost:3306/photo_cn?connection_limit=10
-REDIS_URL_CN=redis://localhost:6379
-S3_ENDPOINT=http://localhost:9000
+DATABASE_URL_CN=mysql://root:root@127.0.0.1:3306/photo_cn?connection_limit=10
+REDIS_URL_CN=redis://127.0.0.1:6379
+S3_ENDPOINT=http://127.0.0.1:9000
 S3_REGION=us-east-1
 S3_ACCESS_KEY=photo-dev
 S3_SECRET_KEY=photo-dev-secret