RenameNode and ExpireNode surface ErrNodeNotInNodeStore for an unknown
node; mapStateError only knew ErrNodeNotFound, so they 500'd. Treat both
as not found.
ogen's SecurityError message echoes the operation name and internal
security text. Map it to a clean 401 so the unauthorized body stays small
and leaks nothing.
Mount the ogen-generated server at /api/v1 with bearer-auth and RFC 7807
errors backed by the state layer; gRPC servers stay for the CLI. Add a
servertest API client harness and Health parity tests.
Kristoffer Dalby