[api] define and document error response format

[rfk]

Possibly take inspiration from the way FxA does it (https://github.com/mozilla/fxa-auth-server/blob/master/docs/api.md#response-format)

[cvan]

We use joi, which has its own nice error output. I kind of break the consistency when we return responses for server/database errors. Should remedy that, yes.