Stable machine-readable error code (e.g., EMAIL_NOT_VERIFIED). Optional; populated by endpoints that distinguish multiple error states behind one HTTP status.