fix(chapter-38): close action-plan gaps that can be automated

Chapter: 38 - Action-plan gap closure.

Plain-English map:
Add the missing foundation pieces that can be safely implemented now: a standard error helper with legacy detail compatibility, API-client parsing for the new error envelope, validated env usage for rate limits/CORS/storage, real storage readiness checks, MinIO-backed local object storage in Docker Compose, LLM circuit breaking, backend abort wiring for timed-out provider streams, access-helper tests, HTTP helper tests, and a manual follow-up register.

Why it matters:
The previous chapters handled the main security and infrastructure pulls, but the action plan still had loose ends. This commit tightens the operational boundary without pretending that larger product work like MCP connectors, a durable queue, or seeded browser E2E can be completed safely as drive-by changes.

Principle:
Automate what can be proven, document what needs manual credentials or product direction, and keep compatibility while improving contracts.

Precedent borrowed:
ACTION_PLAN.md, the fork report's testing/self-hosting/security clusters, and independent agent review of the remaining gaps.

Verification:
- npm test --workspace apps/api
- npm run build --workspace apps/api
- tsc -p packages/api-client/tsconfig.json --noEmit
- git diff --check

Upstream base: willchen96/mike@d39f580.