`lumail@2.1.0` returns `{ data, error }` for HTTP calls. Construction still throws if `apiKey` is missing.

API errors keep the HTTP `name`, `message`, and `statusCode`. Permission and confirmation extras live on `error.details`. A 403 is never remapped to 400.

Transport failures use `error.name` of `network_error`, `timeout`, or `aborted` and omit `statusCode`.

GET/PUT/DELETE retry on 429 and retryable network failures. POST/PATCH do not.

`lumail.tools.run(name, params, { autoConfirm: true })` retries once with `confirmationCode` when the tool requires confirm. Default is no auto-confirm.