迁移首批4个错误码：AP台账/查询、待办、工作台功能开关 [09-05-error-explainability-payment-readiness]

10-05 到期例外清单里已设计好的首批 4 个具体调用，现予落码（原方案见
implement.md §14「首批具体分支与验证要求」）：

- ap_operations.feature_disabled（409）：AP 台账/明细查询功能关闭
- ap_operations.query_invalid（400）：AP 台账查询参数校验失败
- todo.feature_disabled（409）：待办功能关闭
- portal.feature_disabled（409）：工作台首页功能关闭

四处均改为调用 buildBusinessValidationError(reasonCode, details, statusCode)，
保留原 HTTP 状态码、featureFlag/reason 等既有 details 字段不变，仅新增精确
reasonCode；不改功能开关判断逻辑、不改权限校验顺序。

- server/src/constants/errorReasons.js + client/src/api/errorReasons.ts：
  注册 4 条原因码及中文文案，服务端/客户端逐字一致。
- scripts/qa/error-reason-legacy-baseline.json：移除这 4 条已迁移的旧例外
  记录（591 → 587），check-error-reason-contract.mjs 主检查与 self-test
  均 PASS，无 new_legacy/stale_exception/unregistered_reason。
- apOperations.permissions.test.js：扩展"功能关闭"断言校验 reasonCode 与
  原 details 字段共存；新增"查询参数非法（功能开启）"400 用例，断言零
  台账业务查询；新增"合法查询仍 200"用例。
- portal.test.js：新增工作台关闭时 409+reasonCode+零业务查询断言（此前
  完全没有覆盖这条路径）。
- todos.test.js：新建（此前 todos 路由零测试覆盖），聚焦 ensureFeatureEnabled
  网关：关闭时 GET/POST 均 409+reasonCode+零 todoItem 查询；开启时正常放行。

验证：server 5 个相关测试文件 286/286 通过；client typecheck/build 通过；
check-ui-design-rules.mjs --strict、check-trellis-governance.mjs、
git diff --check 通过。routes/ 全量回归 872/874（2 个失败为 paymentBatches
BIFF8 导出的既有环境问题，已用 git stash 验证在改动前的 HEAD 上同样失败，
与本次改动无关，不在本次范围内处理）。

剩余 669 条例外记录不变，尚未处理；B/C 两档 57 文件仍需逐模块确认迁移或
提出延期理由，本次不扩大范围。

Co-Authored-By: Claude Sonnet 5 <[email protected]>

server/tests/unit/routes/apOperations.permissions.test.js

@@ -35,7 +35,7 @@ async function buildApp(permissionCodes, enabled = true) {
   });
   app.decorate("hasPermission", (employee, permission) => hasPermission(employee.permissionCodes, permission));
   app.setErrorHandler((error, request, reply) => {
-    reply.code(error.statusCode ?? 500).send({ error: { code: error.code } });
+    reply.code(error.statusCode ?? 500).send({ error: { code: error.code, details: error.details ?? {} } });
   });
   await app.register(apOperationsRoutes, { prefix: "/api" });
   return { app, queries };
@@ -52,7 +52,7 @@ describe("AP full-ledger permission boundary", () => {
         const response = await app.inject({ method: "GET", url });
         expect(response.statusCode).toBe(allowed ? 200 : 403);
         if (!allowed) {
-          expect(response.json()).toEqual({ error: { code: "PERM_001" } });
+          expect(response.json()).toEqual({ error: { code: "PERM_001", details: {} } });
           for (const query of queries) expect(query).not.toHaveBeenCalled();
         }
       }
@@ -88,10 +88,47 @@ describe("AP full-ledger permission boundary", () => {
   it("preserves feature-off refusal without querying financial data", async () => {
     const { app, queries } = await buildApp(["finance.ledger.view"], false);
     try {
-      for (const url of paths) expect((await app.inject({ method: "GET", url })).statusCode).toBe(409);
+      for (const url of paths) {
+        const response = await app.inject({ method: "GET", url });
+        expect(response.statusCode).toBe(409);
+        expect(response.json()).toEqual({
+          error: {
+            code: "VALID_001",
+            details: { featureFlag: "payment_batch_v1_disabled", reason: "flag_force_off", reasonCode: "ap_operations.feature_disabled" },
+          },
+        });
+      }
       for (const query of queries) expect(query).not.toHaveBeenCalled();
     } finally {
       await app.close();
     }
   });
+
+  it("rejects invalid ledger query params with a precise reasonCode and no ledger read", async () => {
+    const { app, queries } = await buildApp(["finance.ledger.view"], true);
+    try {
+      const response = await app.inject({
+        method: "GET",
+        url: "/api/ap-operations/reimbursement-ledger?pageSize=999",
+      });
+      expect(response.statusCode).toBe(400);
+      const body = response.json();
+      expect(body.error.code).toBe("VALID_001");
+      expect(body.error.details.reasonCode).toBe("ap_operations.query_invalid");
+      expect(body.error.details.fieldErrors).toHaveProperty("pageSize");
+      for (const query of queries) expect(query).not.toHaveBeenCalled();
+    } finally {
+      await app.close();
+    }
+  });
+
+  it("still returns 200 for a legitimate ledger query when the feature is on", async () => {
+    const { app } = await buildApp(["finance.ledger.view"], true);
+    try {
+      const response = await app.inject({ method: "GET", url: "/api/ap-operations/reimbursement-ledger" });
+      expect(response.statusCode).toBe(200);
+    } finally {
+      await app.close();
+    }
+  });
 });