[jibon57]

This PR standardizes how server responses communicate errors across browser-client APIs, external integrations, and download endpoints. Response messages are centralized in pkg/config; internal operational errors are logged server-side and replaced with safe caller-appropriate messages.

Changes

• Separate browser-facing API i18n-key messages from curated English messages for Auth, LTI, and BBB integrations.
• Classify callers through trusted route middleware so shared handlers return the appropriate message format.
• Replace raw operational errors in controller responses with config-owned messages; log details at the failure site where possible.
• Clean up response handling across recording, file, artifact, LTI, and other affected controller/model paths, preserving expected validation and not-found errors.
• Harden recording-task and download responses. Download endpoints use curated English, never expose verifier or filesystem errors, and may include only a sanitized filename basename when a verified file is not found.
• Update common response-envelope and client API error handling, and move findTranslationKey into the existing client utilities.
• Add English locale entries for new client-facing i18n keys. No runtime locale loading or new translation library is introduced.