feat(backend): log client-side render errors to the server (#62)

The frontend's error boundaries need somewhere to report to. A boundary that only shows a customer a message leaves nobody knowing it happened, which is the failure shape this project has designed against three times already.

POST /api/client-errors takes a report, truncates its fields, logs it with a [client-error] prefix and returns 204. No storage: the container log is where this project's operational visibility already lives, and a table with a retention policy and an admin screen is a subsystem larger than the issue.

An unrecognised context is a 400 rather than a log line under a guessed label, following parseItemFilters, which refuses a malformed filter instead of coercing it. Oversized fields go the other way and are truncated rather than refused, because an over-long report is still the only record of the failure.

The endpoint gets its own rate limiter rather than reusing passwordResetRequestLimiter, whose comment already warns that its caller-and-email key collapses every caller into one shared bucket on an endpoint without an email. The new one takes the default key generator, which also avoids the ERR_ERL_KEY_GEN_IPV6 warning the custom key produces.

Verified: 138 integration tests pass, 4 of them new, and 79 unit. The unit count rose by one without a test being written — routesAreWrapped.test.ts runs describe.each over the files in src/routes, so a new route file generates a case. The handler is synchronous and needs no asyncRoute wrapper.

Refs #62
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

backend/src/routes/clientErrors.ts

@@ -0,0 +1,44 @@
+import { Router, Request, Response } from 'express';
+import { clientErrorLimiter } from '../rateLimit';
+
+const router = Router();
+
+// The three error boundaries in the frontend. An unrecognised context means the
+// client and the server disagree about something, which is worth surfacing
+// rather than logging under a guessed label — the same reasoning as
+// parseItemFilters refusing a malformed filter instead of coercing it.
+const CONTEXTS: readonly string[] = ['page', 'catalogue', 'modal'];
+
+const MAX_MESSAGE = 500;
+const MAX_STACK = 4000;
+const MAX_COMPONENT_STACK = 4000;
+const MAX_PATH = 200;
+
+// Anything that is not a string becomes empty rather than 'undefined' or
+// '[object Object]', so a malformed field cannot dress itself up as content.
+function clip(value: unknown, max: number): string {
+  if (typeof value !== 'string') {
+    return '';
+  }
+  return value.length > max ? `${value.slice(0, max)}… [truncated]` : value;
+}
+
+// No asyncRoute: this handler is synchronous, so there is no promise for the
+// error middleware to miss.
+router.post('/', clientErrorLimiter, (req: Request, res: Response) => {
+  const context: unknown = req.body?.context;
+  if (typeof context !== 'string' || !CONTEXTS.includes(context)) {
+    return res.status(400).json({ error: 'invalid context' });
+  }
+
+  console.error(
+    `[client-error] context=${context} path=${clip(req.body?.path, MAX_PATH)}\n` +
+      `  message: ${clip(req.body?.message, MAX_MESSAGE)}\n` +
+      `  stack: ${clip(req.body?.stack, MAX_STACK)}\n` +
+      `  componentStack: ${clip(req.body?.componentStack, MAX_COMPONENT_STACK)}`
+  );
+
+  res.status(204).end();
+});
+
+export default router;