fix(audit-tier-2): error-surface hygiene — toastError + CodedError sweep

Two mechanical sweeps closing the audit's HIGH §16 + MED §11 findings:

* 38 client components / 56 toast.error sites converted to
  toastError(err) so the new admin error inspector becomes usable from
  user-reported issues — every failed inline-edit, save, send, archive,
  upload, etc. now carries the request-id + error-code (Copy ID action).
* 26 service files / 62 bare-Error throws converted to CodedError or
  the existing AppError subclasses.  Adds new error codes:
  DOCUMENSO_UPSTREAM_ERROR (502), DOCUMENSO_AUTH_FAILURE (502),
  DOCUMENSO_TIMEOUT (504), OCR_UPSTREAM_ERROR (502),
  IMAP_UPSTREAM_ERROR (502), UMAMI_UPSTREAM_ERROR (502),
  UMAMI_NOT_CONFIGURED (409), and INSERT_RETURNING_EMPTY (500) for
  post-insert returning-empty guards.
* Five vitest assertions updated to match the new user-facing wording
  (client-merge "already been merged", expense/interest "couldn't find
  that …", documenso "signing service didn't respond").

Test status: 1168/1168 vitest, tsc clean.

Refs: docs/audit-comprehensive-2026-05-05.md HIGH §16 (auditor-H Issue 1)
+ MED §11 (auditor-G Issue 1).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/components/clients/contacts-editor.tsx

@@ -27,6 +27,7 @@ import { InlineEditableField } from '@/components/shared/inline-editable-field';
 import { InlinePhoneField } from '@/components/shared/inline-phone-field';
 import { PhoneInput, type PhoneInputValue } from '@/components/shared/phone-input';
 import { apiFetch } from '@/lib/api/client';
+import { toastError } from '@/lib/api/toast-error';
 import { cn } from '@/lib/utils';
 
 interface Contact {
@@ -161,7 +162,7 @@ function ContactRow({
     try {
       await onUpdate({ isPrimary: !contact.isPrimary });
     } catch (err) {
-      toast.error(err instanceof Error ? err.message : 'Failed to update');
+      toastError(err);
     }
   }
 
@@ -170,7 +171,7 @@ function ContactRow({
     try {
       await onUpdate({ channel: next });
     } catch (err) {
-      toast.error(err instanceof Error ? err.message : 'Failed to update');
+      toastError(err);
     }
   }
 
@@ -343,7 +344,7 @@ function NewContactForm({
           label: label.trim() || undefined,
         });
       } catch (err) {
-        toast.error(err instanceof Error ? err.message : 'Failed to add contact');
+        toastError(err);
       } finally {
         setSaving(false);
       }
@@ -354,7 +355,7 @@ function NewContactForm({
     try {
       await onSave({ channel, value: value.trim(), label: label.trim() || undefined });
     } catch (err) {
-      toast.error(err instanceof Error ? err.message : 'Failed to add contact');
+      toastError(err);
     } finally {
       setSaving(false);
     }

src/components/clients/gdpr-export-button.tsx

@@ -22,6 +22,7 @@ import {
 import { Badge } from '@/components/ui/badge';
 import { usePermissions } from '@/hooks/use-permissions';
 import { apiFetch } from '@/lib/api/client';
+import { toastError } from '@/lib/api/toast-error';
 
 interface ExportRow {
   id: string;
@@ -79,7 +80,7 @@ export function GdprExportButton({ clientId }: { clientId: string }) {
       setEmailOverride('');
     },
     onError: (err: unknown) => {
-      toast.error(err instanceof Error ? err.message : 'Failed to queue export');
+      toastError(err);
     },
   });
 
@@ -92,7 +93,7 @@ export function GdprExportButton({ clientId }: { clientId: string }) {
       );
       window.open(res.data.url, '_blank', 'noopener');
     } catch (err) {
-      toast.error(err instanceof Error ? err.message : 'Failed to fetch download URL');
+      toastError(err);
     }
   }