fix(server/api): preserve 500-class messages via apierror.InternalMsg

The PR1-T2 admin handler migration replaced bespoke 500-class messages
("lookup failed", "refetch failed", "trigger failed", "bump failed",
"remove failed", "update failed", "schedule row missing", "re-read
failed", "read failed") with apierror.Internal(err), which forces the
wire Message to "internal server error". That violates the PR1
contract that errEnvelope{Code, Message} must remain byte-identical
for existing clients.

Add apierror.InternalMsg(message, cause) — a 500-class constructor
that preserves the call site's user-facing message while keeping the
cause attached for logging and errors.Is. Re-migrate the 12 admin
sites whose pre-1cc7eb6 source had a non-empty bespoke Message so
they restore the original wire string. Sites whose original Message
was empty stay on Internal(err) (humanization to "internal server
error" is a tolerable improvement, not a regression).

admin_smtp.go's send_failed site (line 129) was already preserved
via a raw &apierror.Error literal in 1cc7eb6 and needs no fix.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

internal/apierror/apierror_test.go

@@ -143,6 +143,23 @@ func TestConstructors_FieldsCorrect(t *testing.T) {
 	}
 }
 
+func TestInternalMsg(t *testing.T) {
+	cause := errors.New("db down")
+	e := InternalMsg("lookup failed", cause)
+	if e.Status != 500 {
+		t.Errorf("Status = %d, want 500", e.Status)
+	}
+	if e.Code != "server_error" {
+		t.Errorf("Code = %q, want server_error", e.Code)
+	}
+	if e.Message != "lookup failed" {
+		t.Errorf("Message = %q, want lookup failed", e.Message)
+	}
+	if !errors.Is(e, cause) {
+		t.Errorf("expected Is(cause) to be true")
+	}
+}
+
 func TestSentinels_Identity(t *testing.T) {
 	wrapped := fmt.Errorf("ctx: %w", ErrNotFound)