User management in Node.js
From a once over 


Not everybody in CR agrees, but I find tabular data best presented in an aligned format:

var API = {                            
  list:   [list  , 'private'],     
  login:  [login , 'public' ],    
  logout: [logout, 'private'],     
  add:    [add   , 'admin'  ],   
  remove: [remove, 'admin'  ],   
  edit:   [edit  , 'admin'  ]      
};                           

For your error handing, I would mention that using express is very nice for error handling. If you insist on doing it yourself you could do something like 

function handle( f ){
  return function( err ){
    if(err){
      console.error('ERROR: ', err.message);
      return;
    }
    f.apply( this , arguments );
  }
}


Then you can 

function remove(req, res) {
  find(req.body.username, handle( function (err, user) {
    user.remove( handle( function (err) {
      res.send('OK');
    }));
  }));
}

For your error message constants, I would declare them all together on top
I am ambivalent about using an array for your API config instead of an object, if you keep using that, I would suggest you use named constants declared on top:

    var callback   = API[label][CALLBACK];   //Where CALLBACK is earlier declared as 0
    var permission = API[label][PERMISSION]; //Where PERMISSION is earlier declared as 1