db-error-translation: field error translator, 9 leak site fixes, lint enforcement
Add web.FieldErrorsFromDB — a constraint-name-to-field translator that converts
PostgreSQL constraint violations into 422 FieldErrors (per the §6 error contract)
instead of leaking raw driver text to users.
- New web/dberrors.go: FieldErrorsFromDB + ConstraintMessages map
- New web/dberrors_test.go: constraint hits, per-class fallbacks (23505/23503/23514/22001),
nil map, non-Postgres, 23P01 exclusion requires named entry
- Fix 9 leak sites: workspace creation, enrollment (IssueGrant/ExtendGrant/
CreateNonPlanGrant/RevokeGrantAndTransition), org type default-plan update,
entitlement set CRUD, product create/update
- New lint rule raw-error-render: flags err.Error() on any line touching a UI sink
(render*, fireErrorToast, fireSuccessToast, http.Error), exempts slog lines
- Docs: add §4 db-write-failure contract and §9 anti-pattern row
Closes: openspec/changes/db-error-translation
cgalo5758
c71115b51a