Refactor error handling and logging in API responses

docs/android-questionnaire-api.md

@@ -31,7 +31,34 @@ Use the front-controller routes under `/api/...`. The clean route `/api/app_ques
 }
 ```
 
-Some low-level auth failures can still return a legacy body such as `{"error":"Missing Bearer token"}` or `{"error":"Invalid or expired token"}`.
+Auth and permission failures use the same envelope, for example:
+
+```json
+{
+  "ok": false,
+  "error": {
+    "code": "UNAUTHORIZED",
+    "message": "Invalid or expired token"
+  }
+}
+```
+
+Submit validation failures (`POST /api/app_questionnaires`) return `code` `VALIDATION_FAILED` with a `details.errors` array:
+
+```json
+{
+  "ok": false,
+  "error": {
+    "code": "VALIDATION_FAILED",
+    "message": "Some answers are invalid or missing",
+    "details": {
+      "errors": [
+        { "questionID": "q3", "code": "MISSING_ANSWER", "message": "Required question is not answered" }
+      ]
+    }
+  }
+}
+```
 
 ## Authentication