chore(api): p1a final-review hygiene items

- contracts: add NOT_FOUND error code (framework-level 404 for unknown
  routes); Error enum + regen committed
- api: 404 default mapping in AllExceptionsFilter now NOT_FOUND (was
  ALBUM_NOT_FOUND); business 404s unchanged via explicit ApiException codes
- api: extract configureApp (prefix/CORS/x-powered-by) shared by main-cn
  bootstrap and e2e; disable x-powered-by, asserted in e2e
- api: move parseCursor/parseLimit (+page-size bounds) from
  albums.controller to shared/pagination; members/uploads/public re-pointed
- infra: bind compose published ports to 127.0.0.1 (mysql/redis/minio);
  .env.example endpoints follow suit
- e2e: unknown-route 404 NOT_FOUND + x-powered-by absent cases added
  (api e2e 120 -> 122)

Co-Authored-By: Claude Code <noreply@anthropic.com>

packages/contracts/src/errors.ts

@@ -7,6 +7,11 @@ export const ErrorCodes = {
   // 复用 VALIDATION_FAILED 则语义错位。与 openapi.yaml Error enum 同步增补。
   AUTH_RATE_LIMITED: 'AUTH_RATE_LIMITED',
   AUTH_FORBIDDEN: 'AUTH_FORBIDDEN',
+  // P1a 终审修缮①（P1b Task 1 补登）：框架级 404（未注册路由等）此前兜底映射
+  // ALBUM_NOT_FOUND，语义错位。业务 404 一律经 ApiException 显式携带域码；
+  // NOT_FOUND 仅代表"框架/路由层面的资源不存在"。与 openapi.yaml Error enum
+  // 同步增补。
+  NOT_FOUND: 'NOT_FOUND',
   ALBUM_NOT_FOUND: 'ALBUM_NOT_FOUND',
   ALBUM_NOT_PUBLIC: 'ALBUM_NOT_PUBLIC',
   ALBUM_UPLOAD_DISABLED: 'ALBUM_UPLOAD_DISABLED',