fix(salary): stop RLS from failing vab/parental absence registration (#1568)

Migration 20260517135000 rewrote the franvaro-specifikationsnummer trigger
functions to insert audit rows into salary_absence_franvaro_audit, a table
with RLS enabled and zero policies, while leaving the functions SECURITY
INVOKER (its comment claimed implicit SECURITY DEFINER, which is false in
Postgres). Every vab/parental insert from role authenticated (dashboard
absence POST, web /pending approval, in-app Assistenten chat) then failed
with 42501, surfaced as a generic 500, and left no diagnosable trace.

- New migration 20260813120000: ALTER both trigger functions to SECURITY
  DEFINER with search_path pinned to public, pg_temp. No RLS policy is added
  on the audit table: trigger/service-only writes stay the design intent.
- mapInsertError: 42501 now maps to the new bilingual DB_PERMISSION_DENIED
  code instead of INTERNAL_ERROR, and 23514 is split so only the 24h-cap
  trigger's 'Total tid' message becomes ABSENCE_HOURS_CONFLICT; other CHECK
  violations map to VALIDATION_ERROR.
- commitRegisterAbsence/commitDeleteAbsence: log the underlying PG details
  and persist the sanitized structured code in result_data.error_code so the
  next failure is traceable from the op row.
- Dashboard absence route: only ABSENCE_HOURS_CONFLICT passes details.message
  through to the client; every other code shows the registry Swedish message
  instead of raw Postgres text.
- New pg-real regression test locks the authenticated-role parental/vab
  insert path, the shared per-month specnummer sequence, the audit rows, and
  idempotent upsert retries.

Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

lib/salary/absence.ts

@@ -91,11 +91,23 @@ function mapInsertError(error: { code?: string; message?: string }): {
   code: string
   details?: Record<string, unknown>
 } {
-  // The 24h cap trigger raises check_violation when worked + absence > 24h
-  // for the same date.
-  if (error.code === '23514' || error.message?.includes('Total tid')) {
+  // Privilege/RLS denial (42501). Seen when a DB trigger writes to a
+  // protected table as SECURITY INVOKER (the franvaro audit-table bug fixed
+  // in migration 20260813120000): a server-side configuration error, kept
+  // distinct from INTERNAL_ERROR so the failure mode is diagnosable.
+  if (error.code === '42501') {
+    return { code: 'DB_PERMISSION_DENIED', details: { message: error.message } }
+  }
+  // The 24h cap trigger raises check_violation with 'Total tid' text when
+  // worked + absence hours exceed 24h for the same date.
+  if (error.message?.includes('Total tid')) {
     return { code: 'ABSENCE_HOURS_CONFLICT', details: { message: error.message } }
   }
+  // Any other CHECK violation (hours range, absence_type enum) is invalid
+  // input, not an hours conflict.
+  if (error.code === '23514') {
+    return { code: 'VALIDATION_ERROR', details: { message: error.message } }
+  }
   return { code: 'INTERNAL_ERROR', details: { message: error.message } }
 }