feat: POST /api/suggest with error mapping #26

Goal

An integrator or the web page asks for a suggestion with one HTTP call and gets either the suggestion or a JSON error with a code. The service refuses to start with an invalid knowledge base. This is task T7 in specs/001-reply-and-upsell/tasks.md.

Acceptance criteria

• create_app(kb: KnowledgeBase | None = None, client: ModelClient | None = None) in src/reply_assistant/app.py. With both given, the application uses them and reads no settings. With either missing, it reads Settings when it starts, loads the knowledge base from settings.kb_path and builds OpenAICompatibleClient.from_settings(settings) for what is missing.
• An invalid knowledge base stops the start with the KnowledgeBaseError of the loader, which names the field (R4).
• POST /api/suggest takes {"message": "..."}, validated by SuggestionRequest, calls suggest and returns the Suggestion as JSON (R18, R7).
• Every error is a JSON object with exactly the keys code and message (R21): an invalid body gives 422 invalid_request; SuggestionRejectedError gives 502 suggestion_rejected with a message that names the check; a ProviderError of kind timeout gives 504 provider_timeout; any other ProviderError gives 502 provider_error. The application writes the message itself: the text of a provider error never reaches the response.
• GET /health keeps its answer. The client fixture in tests/conftest.py builds the application from the English example and FakeModelClient([]) of tests/acceptance/fakes.py, so the health tests read no settings.
• The acceptance tests in tests/acceptance/test_api.py pass with the pytestmark line removed.
• Every command from Commands in AGENTS.md passes, and the pull request names the defect behind each new test.

Specification

specs/001-reply-and-upsell/spec.md, requirements R4, R18 and R21.

Files in scope

• src/reply_assistant/app.py
• tests/conftest.py
• tests/test_app.py, new, only for behaviour the acceptance tests do not cover
• tests/acceptance/test_api.py, the pytestmark line only

Out of scope

• The web page (T8), the CRM webhook (T10) and the second provider (T9).
• Any new dependency.

Acceptance test

tests/acceptance/test_api.py