fix(compiler): stop error {} from swallowing response {} bugs in api blocks

Client codegen chained .then().catch(), so a .catch() after .then()
caught exceptions thrown by the response body too. Switched to the
two-argument then(onFulfilled, onRejected) form, whose rejection
handler cannot see errors from the fulfilment handler.

SSR codegen wrapped both the transport call and the response-body eval
in the same try; only __wrnexusCallApi is now inside the try, and
__wrnexusEvalData runs after it, outside.

Also verifies (and locks in with a regression test) that GET query
numbers already coerce correctly through defineEndpoint + checkField,
and documents that in the typed-api-block spec.

docs/superpowers/specs/2026-08-19-typed-api-block-design.md

@@ -158,6 +158,22 @@ A plain handler returning `Response.json` has no `defineEndpoint` contract, so `
 to `unknown`. The block's declared types are used directly and the generator emits a warning naming
 the route. Untyped endpoints stay visible rather than silently passing.
 
+### GET parameters travel as strings
+
+A `GET` block's `parameters` become a query string (see Request assembly below), and every
+`URLSearchParams` value is text on the wire regardless of the declared field type — a block
+declaring `age?: number` still sends and receives `"30"`, not `30`. The declared type is honest
+only because the endpoint's own schema coerces it back: `checkField` in
+`packages/validation/src/index.ts` calls `Number(pre)` for every `v.number()` field — optional or
+required — before the handler ever sees it, so `defineEndpoint({ input: v.object({ age:
+v.number() }) })` invoked as `?age=30` hands the handler an actual `number` (verified end to end;
+regression-tested in `packages/core/test/endpoint-schema.test.ts`, "a GET request coerces a
+v.number() query param to an actual number"). This is a property of the endpoint's schema, not of
+the `api` block or the generated contract types — a route that reads `ctx.url.searchParams`
+directly, with no `defineEndpoint` schema, receives raw strings and gets no coercion, but that
+route also has no contract for the generator to check against, so it already falls under "Routes
+without a contract" above and is flagged there.
+
 ### Staleness
 
 Checking is only as current as the generated file, so this stays wired into the existing