chore(api): p1a final-review hygiene items

- contracts: add NOT_FOUND error code (framework-level 404 for unknown
  routes); Error enum + regen committed
- api: 404 default mapping in AllExceptionsFilter now NOT_FOUND (was
  ALBUM_NOT_FOUND); business 404s unchanged via explicit ApiException codes
- api: extract configureApp (prefix/CORS/x-powered-by) shared by main-cn
  bootstrap and e2e; disable x-powered-by, asserted in e2e
- api: move parseCursor/parseLimit (+page-size bounds) from
  albums.controller to shared/pagination; members/uploads/public re-pointed
- infra: bind compose published ports to 127.0.0.1 (mysql/redis/minio);
  .env.example endpoints follow suit
- e2e: unknown-route 404 NOT_FOUND + x-powered-by absent cases added
  (api e2e 120 -> 122)

Co-Authored-By: Claude Code <noreply@anthropic.com>

services/api/src/albums/albums.controller.ts

@@ -3,8 +3,8 @@
 // listAlbums/getAlbum/updateAlbum）。控制器级 SessionGuard：四端点全需认证
 // （契约均有 bearerAuth、无 security: [] 例外）。职责仅剩：
 //   · 透传认证用户（req.user，守卫挂载）；
-//   · 查询参数规整（limit 1..100 整数、cursor 长度），非法 → 400
-//     VALIDATION_FAILED，与 body 校验同一出口；
+//   · 查询参数规整（limit 1..100 整数、cursor 长度）经 shared/pagination
+//     （P1a 终审修缮③迁出本控制器），非法 → 400 VALIDATION_FAILED；
 //   · 权限/可见性→HTTP 映射交由服务层抛 ApiException（404 ALBUM_NOT_FOUND）。
 import {
   Body,
@@ -22,19 +22,17 @@ import { ErrorCodes } from '@photo/contracts';
 import { ApiException } from '../api-exception';
 import type { AuthUser } from '../auth/session.guard';
 import { AuthenticatedRequest, SessionGuard } from '../auth/session.guard';
+import { parseCursor, parseLimit } from '../shared/pagination';
 import {
-  DEFAULT_ALBUM_PAGE_SIZE,
-  MAX_ALBUM_PAGE_SIZE,
   type AlbumListResponse,
   type AlbumResponse,
   AlbumsService,
 } from './albums.service';
 import { AlbumCreateRequestDto, AlbumUpdateRequestDto } from './dto';
-import { MAX_CURSOR_LENGTH } from '../shared/cursor';
 
 /**
  * 守卫放行后提取 req.user；防御性兜底（守卫未挂载属装配错误，按未认证拒绝）。
- * members/categories 控制器（Task 17）复用同一判定，导出。
+ * members/categories/photos/uploads 控制器复用同一判定，导出。
  */
 export function userOf(req: AuthenticatedRequest): AuthUser {
   if (req.user === undefined) {
@@ -47,46 +45,6 @@ export function userOf(req: AuthenticatedRequest): AuthUser {
   return req.user;
 }
 
-/** limit 查询参数：缺省 20，须为 1..100 的十进制整数（契约 bounds）。导出供
- *  members 列表（Task 17，同契约 bounds）复用。 */
-export function parseLimit(raw: string | undefined): number {
-  if (raw === undefined || raw === '') {
-    return DEFAULT_ALBUM_PAGE_SIZE;
-  }
-  if (!/^\d+$/.test(raw)) {
-    throw new ApiException(
-      ErrorCodes.VALIDATION_FAILED,
-      'limit 必须是 1-100 的整数',
-      HttpStatus.BAD_REQUEST,
-    );
-  }
-  const limit = Number.parseInt(raw, 10);
-  if (limit < 1 || limit > MAX_ALBUM_PAGE_SIZE) {
-    throw new ApiException(
-      ErrorCodes.VALIDATION_FAILED,
-      'limit 必须是 1-100 的整数',
-      HttpStatus.BAD_REQUEST,
-    );
-  }
-  return limit;
-}
-
-/** cursor 查询参数：仅做长度规整（语义校验在服务层解码时）；导出供 members
- *  列表（Task 17）复用。 */
-export function parseCursor(raw: string | undefined): string | undefined {
-  if (raw === undefined || raw === '') {
-    return undefined;
-  }
-  if (raw.length > MAX_CURSOR_LENGTH) {
-    throw new ApiException(
-      ErrorCodes.VALIDATION_FAILED,
-      'cursor 不合法',
-      HttpStatus.BAD_REQUEST,
-    );
-  }
-  return raw;
-}
-
 @Controller('albums')
 @UseGuards(SessionGuard)
 export class AlbumsController {