fix(api): drop contextually-wrong "anon resources auto-expire" hint from generic 404 (BUG-API-105)

The generic "not_found" agent_action used to tack on "anon resources
also auto-expire after 24h" — irrelevant when the 404 is a typo'd path,
unknown internal endpoint, or authenticated misroute. Hint is kept on
the surface-specific 404s (webhook_not_found etc.) where the auto-
expire footnote IS actionable.

Coverage block:
  Symptom:        404 agent_action says "anon resources auto-expire" on
                  any 404 including internal/typo'd routes
  Enumeration:    rg 'anon resources' internal/ --type go
  Sites found:    2 — webhook_not_found (kept; correct context) +
                  generic not_found (changed)
  Sites touched:  1 (generic not_found)
  Coverage test:  N/A — agent_action contract is the prose itself; no
                  test pins the exact wording for the generic 404 today.
  Live verified:  pending merge + auto-deploy + curl unknown path

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: mastermanas805

internal/handlers/helpers.go

@@ -343,7 +343,14 @@ var codeToAgentAction = map[string]errorCodeMeta{
 	// StatusNotFound / StatusMethodNotAllowed / StatusRequestEntityTooLarge
 	// / StatusUnsupportedMediaType.
 	"not_found": {
-		AgentAction: "Tell the user the URL is wrong or the resource no longer exists. Have them check the path against https://instanode.dev/docs — anon resources also auto-expire after 24h, so re-provision if needed.",
+		// BUG-API-105 (QA 2026-05-29): the agent_action used to tack on
+		// "anon resources also auto-expire after 24h" — irrelevant when
+		// the 404 is a typo'd internal path or unknown route, and
+		// actively misleading on authenticated misroutes. Hint kept
+		// behind a "see /docs" pointer; the auto-expire footnote now
+		// only fires when the surface-specific 404 (resource_not_found
+		// / webhook_not_found / etc.) emits it.
+		AgentAction: "Tell the user the URL is wrong or the resource no longer exists. Have them check the path against https://instanode.dev/docs — if they were calling a token-keyed URL the token may have expired or been mistyped.",
 	},
 	"method_not_allowed": {
 		AgentAction: "Tell the user the HTTP method is wrong for this URL. Have them check the Allow response header (or https://instanode.dev/docs) for the supported methods.",