fix(frontend): readable API errors and no more silent action failures (#284, #286)

#286: request() now throws C2ApiError — message is FastAPI's `detail` or a
plain sentence for the status (401/403/404/429/5xx), with toString() so the
many String(e) call sites read cleanly. status/body stay on the error; the
Discord parsers rebuild the legacy "C2 API error N: body" text via
legacyErrorText(), so their invite/code parsing is unchanged.

#284: Resolve, Regenerate summary, alert-rule toggle/delete/load,
Acknowledge, trip deletes, system delete and Restart OP25 now surface
failures (ErrorBanner where the page has one, alert() where the page
already uses it). Rules tab no longer says "No alert rules configured"
when the load failed. Confirms added for Resolve (no reopen path exists),
rule delete and trip delete. Reopen deliberately not built — manual
resolve doesn't set resolved_at, so reopening is a lifecycle change.

Frontend unverified: no Node on the authoring box (#207).

Closes #286

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

drb-frontend/lib/discordOAuth.ts

@@ -9,6 +9,7 @@
 // browser: the code exchange happens in c2-core.
 
 import { auth } from "@/lib/firebase";
+import { C2ApiError } from "@/lib/c2error";
 
 const BASE = process.env.NEXT_PUBLIC_C2_URL ?? "http://localhost:8000";
 
@@ -24,7 +25,7 @@ async function send<T>(method: "POST" | "PUT" | "DELETE", path: string, body?: o
     },
     ...(body ? { body: JSON.stringify(body) } : {}),
   });
-  if (!res.ok) throw new Error(`C2 API error ${res.status}: ${await res.text()}`);
+  if (!res.ok) throw new C2ApiError(res.status, await res.text());
   if (res.status === 204) return undefined as T;
   return res.json();
 }
@@ -58,7 +59,7 @@ export async function startDiscordOAuth(req: OAuthStartRequest): Promise<OAuthSt
   try {
     raw = await post("/discord/oauth/start", req);
   } catch (err) {
-    if (err instanceof Error && /^C2 API error 404:/.test(err.message)) throw new OAuthNotConfigured(err.message);
+    if (err instanceof C2ApiError && err.status === 404) throw new OAuthNotConfigured(err.message);
     throw err;
   }
   const url = raw.url ?? raw.authorize_url ?? "";