fix(audit-tier-2): error-surface hygiene — toastError + CodedError sweep

Two mechanical sweeps closing the audit's HIGH §16 + MED §11 findings:

* 38 client components / 56 toast.error sites converted to
  toastError(err) so the new admin error inspector becomes usable from
  user-reported issues — every failed inline-edit, save, send, archive,
  upload, etc. now carries the request-id + error-code (Copy ID action).
* 26 service files / 62 bare-Error throws converted to CodedError or
  the existing AppError subclasses.  Adds new error codes:
  DOCUMENSO_UPSTREAM_ERROR (502), DOCUMENSO_AUTH_FAILURE (502),
  DOCUMENSO_TIMEOUT (504), OCR_UPSTREAM_ERROR (502),
  IMAP_UPSTREAM_ERROR (502), UMAMI_UPSTREAM_ERROR (502),
  UMAMI_NOT_CONFIGURED (409), and INSERT_RETURNING_EMPTY (500) for
  post-insert returning-empty guards.
* Five vitest assertions updated to match the new user-facing wording
  (client-merge "already been merged", expense/interest "couldn't find
  that …", documenso "signing service didn't respond").

Test status: 1168/1168 vitest, tsc clean.

Refs: docs/audit-comprehensive-2026-05-05.md HIGH §16 (auditor-H Issue 1)
+ MED §11 (auditor-G Issue 1).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/components/documents/document-detail.tsx

@@ -13,6 +13,7 @@ import { PageHeader } from '@/components/shared/page-header';
 import { StatusPill, type StatusPillStatus } from '@/components/ui/status-pill';
 import { useRealtimeInvalidation } from '@/hooks/use-realtime-invalidation';
 import { apiFetch } from '@/lib/api/client';
+import { toastError } from '@/lib/api/toast-error';
 
 interface DetailDoc {
   id: string;
@@ -151,7 +152,7 @@ export function DocumentDetail({ documentId, portSlug }: DocumentDetailProps) {
       toast.success('Reminder sent');
       queryClient.invalidateQueries({ queryKey: ['document-detail', documentId] });
     } catch (err) {
-      toast.error(err instanceof Error ? err.message : 'Failed to send reminder');
+      toastError(err);
     }
   };
 
@@ -163,7 +164,7 @@ export function DocumentDetail({ documentId, portSlug }: DocumentDetailProps) {
       toast.success('Document cancelled');
       router.push(`/${portSlug}/documents`);
     } catch (err) {
-      toast.error(err instanceof Error ? err.message : 'Cancel failed');
+      toastError(err);
       setIsCancelling(false);
     }
   };
@@ -177,7 +178,7 @@ export function DocumentDetail({ documentId, portSlug }: DocumentDetailProps) {
         `Email composer prepared for ${draft.data.to.length} signer${draft.data.to.length === 1 ? '' : 's'} - opens in PR8 wizard`,
       );
     } catch (err) {
-      toast.error(err instanceof Error ? err.message : 'Failed to prepare email');
+      toastError(err);
     }
   };
 
@@ -357,9 +358,7 @@ export function DocumentDetail({ documentId, portSlug }: DocumentDetailProps) {
                             queryKey: ['document-detail', documentId],
                           });
                         } catch (err) {
-                          toast.error(
-                            err instanceof Error ? err.message : 'Failed to remove watcher',
-                          );
+                          toastError(err);
                         }
                       }}
                       className="text-muted-foreground hover:text-destructive"