fix(salary): surface employee-save failures and a typed 503 for the missing encryption key (#1996) (#2009)

* fix(salary): surface employee-save failures in the dialog and type the missing encryption key (#1996)

Pressing Spara in "Ny anställd" could fail without any feedback: a thrown
fetch or a non-JSON 5xx body escaped handleSubmit before setSaving(false)
ran, leaving the button stuck on "Sparar..." and the dialog silent. Even
when the toast did fire, the Radix modal aria-hides the root-layout
Toaster, so assistive tech (and the E2E driver that found this) heard
nothing, and the requestId support needs was never shown anywhere.

- NewEmployeeDialog: fetch + parse run in a never-throwing helper, saving
  is released in finally, the body is parsed with json().catch(() => null)
  so an HTML/plain-text error page still maps through the HTTP-status map,
  and the failure is rendered inline (role="alert" in the footer) with
  "Ärende-id: <requestId>" next to the single destructive toast.
- personnummer.ts: the production "key missing" throw now carries the
  registry code PERSONNUMMER_ENCRYPTION_NOT_CONFIGURED, and the SALARY
  registry gains a 503 entry naming PERSONNUMMER_ENCRYPTION_KEY with a
  "contact support" message and a remediation hint. withRouteContext
  emits the typed envelope automatically instead of INTERNAL_ERROR 500,
  which read as transient and invited retries that can never succeed.
- Tests for the route (401, 400, 503 with requestId and no insert), the
  key guard, the registry entry, errorResponse dispatch on a coded Error,
  and getErrorMessage locale handling of the new envelope.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015nAd8XJ2RPCmG2eKoLBdna

* fix(salary): address review findings (#1996)

- NewEmployeeDialog: fall back to the X-Request-Id response header when the
  body carries no error.requestId. The route hand-builds its 409 (duplicate
  personnummer) and generic insert-failure 500 bodies as flat strings, so the
  inline "Ärende-id" line was hidden for exactly the DB-failure class the
  issue names; withRouteContext sets the header on every response.
- Route tests pin that the 409 and 500 insert-error arms carry X-Request-Id.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015nAd8XJ2RPCmG2eKoLBdna

---------

Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

lib/errors/__tests__/structured-errors.test.ts

@@ -58,6 +58,18 @@ describe('structured-errors registry', () => {
     }
   })
 
+  it('registers PERSONNUMMER_ENCRYPTION_NOT_CONFIGURED as a 503 configuration gap (#1996)', () => {
+    const entry = getErrorEntry('PERSONNUMMER_ENCRYPTION_NOT_CONFIGURED')
+    expect(entry).toBeDefined()
+    expect(entry?.httpStatus).toBe(503)
+    expect(entry?.message_sv).toContain('PERSONNUMMER_ENCRYPTION_KEY')
+    expect(entry?.message_sv).toMatch(/Kontakta supporten/)
+    expect(entry?.message_en).toContain('PERSONNUMMER_ENCRYPTION_KEY')
+    expect(entry?.remediation?.description).toContain('PERSONNUMMER_ENCRYPTION_KEY')
+    // Retrying without the variable fails identically: never mark it transient.
+    expect(entry?.retryable).toBeFalsy()
+  })
+
   it('listErrorCodes returns at least the bookkeeping + generic + provider codes', () => {
     const codes = listErrorCodes()
     expect(codes.length).toBeGreaterThan(20)
@@ -73,6 +85,23 @@ describe('structured-errors registry', () => {
 })
 
 describe('errorResponse', () => {
+  it('maps a plain Error carrying a registry code to that code, status and requestId', async () => {
+    // The shape lib/salary/personnummer.ts throws when the key is unset in
+    // production: an Error with a `code` own-property, no class hierarchy.
+    const err = Object.assign(new Error('PERSONNUMMER_ENCRYPTION_KEY is required in production'), {
+      code: 'PERSONNUMMER_ENCRYPTION_NOT_CONFIGURED',
+    })
+    const res = errorResponse(err, noopLogger, { requestId: 'req_1996' })
+    expect(res.status).toBe(503)
+    expect(res.headers.get('X-Request-Id')).toBe('req_1996')
+    const body = await readEnvelope(res)
+    expect(body.error.code).toBe('PERSONNUMMER_ENCRYPTION_NOT_CONFIGURED')
+    expect(body.error.message).toMatch(/PERSONNUMMER_ENCRYPTION_KEY/)
+    expect(body.error.requestId).toBe('req_1996')
+    // The raw English Error.message must not replace the registry message.
+    expect(body.error.message).not.toBe(err.message)
+  })
+
   it('maps BookkeepingError to its code + structured details + Swedish message', async () => {
     const err = new JournalEntryNotBalancedError(100, 90)
     const res = errorResponse(err, noopLogger, { requestId: 'req_1' })