Document url structure and error codes

(I was going to try to get the proof-of-work stuff written in here as well, but no need to block on that)

This PR updates the API documentation with details on URl structure ("/v1/blah") success codes (all "200 OK") and error codes for each endpoint.  There's a couple of "TODO"s in there that could use some input.

@dannycoates r?

@warner I've introduced two application-level errnos to go along with the "401 Unauthorized" response.  The first is "invalid signature" and the second is "expired token".  The idea is that explicitly indicating "your token has expired" is useful information for the client.  But do we risk some sort of security information leak by having such a code?