[BeSovereign]

Refs #628

Server errors reach the UI as codes with parameters and are shown translated. The booking-settings (#503) and task-list (#495) errors got their own codes, the weekday is named in the UI language, and the not-JSON message keeps its content type. Older E2E mocks that sent bare error text now send real codes and expect the translated text.

Driver gates (measured, not claimed)

• Suites: lint: 1 passed, 0 failed | node: 2034 passed, 0 failed | python: 194 passed, 0 failed | e2e: 354 passed, 0 failed
• Red/green check on declared tests: server/test/issue628_error_codes.test.js, e2e/issue628_settings.spec.js

red/green output

RED without the change:
sue-62-77ae0-60-in-German-and-in-English-chromium/error-context.md

    attachment #3: trace (application/zip) ─────────────────────────────────────────────────────────
    test-results/issue628_settings-Issue-62-77ae0-60-in-German-and-in-English-chromium/trace.zip
    Usage:

        npx playwright show-trace test-results/issue628_settings-Issue-62-77ae0-60-in-German-and-in-English-chromium/trace.zip

    ────────────────────────────────────────────────────────────────────────────────────────────────

  2 failed
    [chromium] › e2e/issue628_settings.spec.js:22:1 › Issue #628 — the settings dialog: topics, keyboard navigation, focus and no inline styles 
    [chromium] › e2e/issue628_settings.spec.js:82:1 › Issue #628 — a server error is shown translated (#160), in German and in English 


GREEN with the change:
/route.js:119:3)
[WebServer]     at Layer.handle [as handle_request] (/home/agent-user/Coding/Freeshard/vacation_framework/worktrees/issue-628/node_modules/express/lib/router/layer.js:95:5)
[WebServer]     at /home/agent-user/Coding/Freeshard/vacation_framework/worktrees/issue-628/node_modules/express/lib/router/index.js:284:15
[WebServer]     at Function.process_params (/home/agent-user/Coding/Freeshard/vacation_framework/worktrees/issue-628/node_modules/express/lib/router/index.js:346:12)
[WebServer]     at next (/home/agent-user/Coding/Freeshard/vacation_framework/worktrees/issue-628/node_modules/express/lib/router/index.js:280:10)
[WebServer]     at Function.handle (/home/agent-user/Coding/Freeshard/vacation_framework/worktrees/issue-628/node_modules/express/lib/router/index.js:175:3)

🤖 Generated with Claude Code

[BeSovereign]

Security review (claude-fable-5-1): no blocking finding. Toast/innerHTML sinks escape; reflected params (detail) never reach the DOM; classify() fails closed to GENERIC; no new input trust, CSRF/auth untouched; e2e catalogue check and 404-shape tests have teeth. Minor: preferences 400s now log full stacks; RRULE detail echoed untruncated in JSON (pre-existing); //api paths lack a code.