v0.14.3 - Unified API errors, database pagination and spam-gated form delivery

Changes

• REST API: every 422 now returns details as an array of {path, message}, on creates and updates alike (previously a raw errors hash on updates and plain strings on creates). path is dotted or indexed for nested values, e.g. fields[1].type.
• Entry tools (entries_get, entries_list, entries_save, entries_query): image fields now return the asset's prefixed id (asst_…), which entries_save accepts back, instead of an internal attachment object. null when unset.
• Liquid {% paginate collection.entries by N %} now runs one count and one offset/limit query instead of loading every published entry before slicing. Other uses of collection.entries are unchanged.
• Forms with spam checking enabled: notification emails and CRM ingestion are held until the spam verdict. A rule hit is marked spam at once and delivers nothing (the visitor still sees the thank-you page); undecided submissions deliver after the AI check unless it says spam. Forms without spam checking deliver immediately, as before.
• Navigation items: an item saved without a priority is placed last among its own siblings, and moving an item to a new parent places it last there. Previously the priority was a tree-wide count, so siblings could tie.
• Sessions: signing out of one pooled session lands on the login page listing the others instead of switching automatically; signing in again as an already-pooled user replaces the earlier session; the session in use is never evicted at the cap.
• Constituent portal: verification codes are delivered by identifier type (phone receives an SMS code, email receives mail); a magic link is never sent to a phone; delivery limits are exactly 5 per destination. SMS body is now "Your Airogel code is …".
• Chat assistant tool errors name what failed ("Collection not found: blog", "Blueprint has been modified since last read") instead of "Validation failed".
• Email events: SES Open and Click events now record their own timestamp, IP, user agent and link.

Fixes

• Page 404s are an explicit resolution with a reason (root_routing, unpublished, no_template); a real render error is no longer masked as a 404.
• Index-page SEO meta: canonical, image and feed-discovery URLs are HTML-escaped.
• Command palette no longer shows results from a superseded search.
• Admin: counter-cache fields are read-only, so edits cannot drift the counts.