Who may reach a route, and what a refused caller is told.

Every route requires a signed-in user unless its route data carries
`:public true` (BOU-568). A refusal has the shape the user module's
`require-authenticated` interceptor answers with, so a client sees one 401
whichever layer refused it: the one error body of
`wagoe.platform.core.http.errors` (BOU-586). No Content-Type: muuntaja encodes a map body
only when none is set (ZZP-120).

The one JSON error body (BOU-586):

  {"error": {"type":           "not-found",
             "message":        "User not found",
             "details":        {...},    ; optional
             "correlation-id": "...",  ; optional
             "dev":            {...}}}   ; optional, dev only (BND code)

Everything about the failure sits inside `error`, so a client reads one
key. `type` is a string: the `:type` keyword of the ex-info, without its
colon.

Exceptions to error responses, and the `:type` -> status table.

The name is historical: these were RFC 7807 bodies until BOU-586 made every
JSON error the one shape of `wagoe.platform.core.http.errors`.