Unify JSON error responses into one canonical shape

All JSON error responses now use a single format built by the new
datasette.utils.error_body() helper:

    {"ok": false, "error": "...", "errors": ["..."], "status": 400}

- error is all messages joined with '; ', errors is the full list,
  status always matches the HTTP status code
- The exception handler no longer emits the legacy title key in JSON
  (it is still available to the HTML error template)
- The permission debug endpoints (/-/allowed, /-/rules, /-/check,
  POST /-/permissions) no longer return bare {"error": ...} objects
- JSON renderer SQL errors keep their rows/truncated context keys but
  now include the canonical keys as well
- _shape=object misuse (queries or tables without primary keys) now
  returns HTTP 400 instead of 200 with an error body
- Method-not-allowed 405 responses use the canonical shape

Adds tests/test_error_shape.py covering all four previous shape
producers, updates affected tests, and documents the format in a new
'Error responses' section of docs/json_api.rst.

Implements section 1 of stable-api-recommendations.md.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GrHZSypDfMnym1tM5XJAFZ

tests/test_table_api.py

@@ -31,8 +31,8 @@ async def test_table_not_exists_json(ds_client):
     assert (await ds_client.get("/fixtures/blah.json")).json() == {
         "ok": False,
         "error": "Table not found",
+        "errors": ["Table not found"],
         "status": 404,
-        "title": None,
     }
 
 
@@ -242,8 +242,8 @@ async def test_table_shape_invalid(ds_client):
     assert response.json() == {
         "ok": False,
         "error": "Invalid _shape: invalid",
+        "errors": ["Invalid _shape: invalid"],
         "status": 400,
-        "title": None,
     }
 
 
@@ -635,8 +635,8 @@ async def test_searchable_invalid_column(ds_client):
     assert response.json() == {
         "ok": False,
         "error": "Cannot search by that column",
+        "errors": ["Cannot search by that column"],
         "status": 400,
-        "title": None,
     }
 
 
@@ -775,7 +775,7 @@ async def test_table_filter_extra_where_invalid(ds_client):
         "/fixtures/facetable.json?_where=_neighborhood=Dogpatch'"
     )
     assert response.status_code == 400
-    assert "Invalid SQL" == response.json()["title"]
+    assert "unrecognized token" in response.json()["error"]
 
 
 def test_table_filter_extra_where_disabled_if_no_sql_allowed():