fix(audit-tier-2): error-surface hygiene — toastError + CodedError sweep

Two mechanical sweeps closing the audit's HIGH §16 + MED §11 findings:

* 38 client components / 56 toast.error sites converted to
  toastError(err) so the new admin error inspector becomes usable from
  user-reported issues — every failed inline-edit, save, send, archive,
  upload, etc. now carries the request-id + error-code (Copy ID action).
* 26 service files / 62 bare-Error throws converted to CodedError or
  the existing AppError subclasses.  Adds new error codes:
  DOCUMENSO_UPSTREAM_ERROR (502), DOCUMENSO_AUTH_FAILURE (502),
  DOCUMENSO_TIMEOUT (504), OCR_UPSTREAM_ERROR (502),
  IMAP_UPSTREAM_ERROR (502), UMAMI_UPSTREAM_ERROR (502),
  UMAMI_NOT_CONFIGURED (409), and INSERT_RETURNING_EMPTY (500) for
  post-insert returning-empty guards.
* Five vitest assertions updated to match the new user-facing wording
  (client-merge "already been merged", expense/interest "couldn't find
  that …", documenso "signing service didn't respond").

Test status: 1168/1168 vitest, tsc clean.

Refs: docs/audit-comprehensive-2026-05-05.md HIGH §16 (auditor-H Issue 1)
+ MED §11 (auditor-G Issue 1).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tests/integration/dedup/client-merge.test.ts

@@ -130,7 +130,7 @@ describe('mergeClients', () => {
     const winner2 = await makeClient({ portId: port.id });
     await expect(
       mergeClients({ winnerId: winner2.id, loserId: loser.id, mergedBy: 'u' }),
-    ).rejects.toThrow(/already merged/i);
+    ).rejects.toThrow(/already been merged/i);
   });
 
   it('drops duplicate contact rows during reattach', async () => {

tests/integration/expense-dedup.test.ts

@@ -197,6 +197,8 @@ describe('expense dedup', () => {
       expenseDate: new Date('2026-04-15T12:00:00Z'),
     });
     await expect(mergeDuplicate(a.id, a.id, portA.id)).rejects.toThrow(/itself/);
-    await expect(mergeDuplicate(a.id, b.id, portA.id)).rejects.toThrow(/not found/);
+    await expect(mergeDuplicate(a.id, b.id, portA.id)).rejects.toThrow(
+      /couldn't find that expense/,
+    );
   });
 });

tests/unit/interest-scoring.test.ts

@@ -306,7 +306,9 @@ describe('calculateInterestScore', () => {
 
   it('throws when interest not found', async () => {
     (db.query.interests.findFirst as ReturnType<typeof vi.fn>).mockResolvedValue(null);
-    await expect(calculateInterestScore('missing', 'p1')).rejects.toThrow('Interest not found');
+    await expect(calculateInterestScore('missing', 'p1')).rejects.toThrow(
+      /couldn't find that interest/,
+    );
   });
 
   it('returns cached result when redis has a hit (after port-scope DB check)', async () => {

tests/unit/services/documenso-place-fields.test.ts

@@ -147,7 +147,7 @@ describe('placeFields v2 dispatch', () => {
         ],
         'port-1',
       ),
-    ).rejects.toThrow(/v2 placeFields/);
+    ).rejects.toThrow(/signing service didn't respond/);
   });
 });
 
@@ -235,7 +235,7 @@ describe('placeFields v1 dispatch', () => {
         ],
         'port-1',
       ),
-    ).rejects.toThrow(/v1 placeField/);
+    ).rejects.toThrow(/signing service didn't respond/);
   });
 });
 
@@ -322,6 +322,6 @@ describe('voidDocument', () => {
   it('throws on other non-2xx responses', async () => {
     configurePort('v2');
     fetchMock.mockResolvedValueOnce(new Response('boom', { status: 500 }));
-    await expect(voidDocument('env-1', 'port-1')).rejects.toThrow(/voidDocument/);
+    await expect(voidDocument('env-1', 'port-1')).rejects.toThrow(/signing service didn't respond/);
   });
 });