chore(api): p1a final-review hygiene items

- contracts: add NOT_FOUND error code (framework-level 404 for unknown
  routes); Error enum + regen committed
- api: 404 default mapping in AllExceptionsFilter now NOT_FOUND (was
  ALBUM_NOT_FOUND); business 404s unchanged via explicit ApiException codes
- api: extract configureApp (prefix/CORS/x-powered-by) shared by main-cn
  bootstrap and e2e; disable x-powered-by, asserted in e2e
- api: move parseCursor/parseLimit (+page-size bounds) from
  albums.controller to shared/pagination; members/uploads/public re-pointed
- infra: bind compose published ports to 127.0.0.1 (mysql/redis/minio);
  .env.example endpoints follow suit
- e2e: unknown-route 404 NOT_FOUND + x-powered-by absent cases added
  (api e2e 120 -> 122)

Co-Authored-By: Claude Code <noreply@anthropic.com>

services/api/src/uploads/uploads.controller.ts

@@ -1,7 +1,7 @@
 // services/api/src/uploads/uploads.controller.ts —— /uploads 端点（Task 18 起；
 // Task 19 增补 listUploads/renewUploadCredential/completeUpload）。方法名与契约
 // operationId 一一对应。控制器级 SessionGuard：端点全需认证。职责：透传认证
-// 用户 + 查询参数规整（parseLimit/parseCursor 复用相册控制器导出，同契约 bounds）。
+// 用户 + 查询参数规整（parseLimit/parseCursor 用 shared/pagination，同契约 bounds）。
 // 注意 DTO 必须值导入（非 import type）：@Body 参数类型经 emitDecoratorMetadata
 // 进入设计期元数据，import type 会令参数在管线中被置为 undefined（Task 18 实测）。
 import {
@@ -16,11 +16,8 @@ import {
   Req,
   UseGuards,
 } from '@nestjs/common';
-import {
-  parseCursor,
-  parseLimit,
-  userOf,
-} from '../albums/albums.controller';
+import { userOf } from '../albums/albums.controller';
+import { parseCursor, parseLimit } from '../shared/pagination';
 import { AuthenticatedRequest, SessionGuard } from '../auth/session.guard';
 import { UploadsService } from './uploads.service';
 import type {