Result box: color-code by status + friendly error messages from error codes (#105)

- Backend create/can validation paths emit machine-readable error codes
  (slug_taken, slug_invalid, content_empty, content_too_large,
  expiry_invalid, rate_limited, ...) alongside the human message
- new.html JS maps codes to plain-language guidance with generic fallback
- Result card colored via --ok/--err/--warn left border (result-ok/err/warn)
- docs/API.md error section documents the code field
- Tests assert the code on every validation path

docs/API.md

@@ -32,9 +32,21 @@ curl -X POST http://localhost:8080/api/pastes \
 - Response includes `id`, `url`, `raw_url`, `api_url`, `expires_at`,
   `created_at`, and a one-time `deletion_token`.
 
-Errors: `400` invalid body/content too large/duplicate slug, `401` password
-required, `404` paste expired/burned/gone, `413` content exceeds max bytes,
-`429` rate limited.
+Errors return JSON with a human-readable `error` message plus a
+machine-readable `code` the web UI maps to plain-language guidance (#105):
+
+| Code | Status | Meaning |
+|---|---|---|
+| `content_empty` | 400 | content is required |
+| `slug_invalid` | 400/409 | custom slug malformed |
+| `slug_taken` | 409 | custom slug already in use |
+| `slug_reserved` | 409 | custom slug is reserved |
+| `expiry_invalid` | 400 | expires_in out of 1 minute – 1 year range |
+| `content_too_large` | 413 | content or body exceeds the size cap |
+| `rate_limited` | 429 | too many requests; see `Retry-After` |
+
+Other statuses: `400` invalid body, `401` password required, `404` paste
+expired/burned/gone. Unknown codes should be treated as a generic failure.
 
 ## Get paste