Initial commit of Descrybe v2 without local scratch artifacts.

Drop one-shot tmp/axe scripts and agent i18n scratch so the Gitea tree is deployable.

apps/api/internal/auth/errors.go

@@ -0,0 +1,41 @@
+package auth
+
+import "errors"
+
+var (
+	ErrRegisterFieldsRequired = errors.New("email, password, and company name are required")
+	ErrPasswordTooShort       = errors.New("password must be at least 8 characters")
+	ErrUserNotFound           = errors.New("user not found")
+	ErrNotCompanyMember       = errors.New("not a member of company")
+	ErrInviteNotFound         = errors.New("invite not found")
+	ErrEmailRequired          = errors.New("email is required")
+	ErrSyntheticEmail         = errors.New("synthetic migration email cannot receive invites")
+	ErrNotEligibleSetPassword = errors.New("user not eligible for set-password invite")
+	ErrEmailMismatch          = errors.New("signed-in email does not match invite email")
+)
+
+// ClientError reports whether err is a known client-facing auth error.
+func ClientError(err error) (msg string, ok bool) {
+	switch {
+	case err == nil:
+		return "", false
+	case errors.Is(err, ErrRegisterFieldsRequired),
+		errors.Is(err, ErrPasswordTooShort),
+		errors.Is(err, ErrPasswordAlreadySet),
+		errors.Is(err, ErrUserExists),
+		errors.Is(err, ErrInviteInvalid),
+		errors.Is(err, ErrInvalidCredentials),
+		errors.Is(err, ErrMustSetPassword),
+		errors.Is(err, ErrUserNotFound),
+		errors.Is(err, ErrNotCompanyMember),
+		errors.Is(err, ErrInviteNotFound),
+		errors.Is(err, ErrTokenInvalid),
+		errors.Is(err, ErrEmailRequired),
+		errors.Is(err, ErrSyntheticEmail),
+		errors.Is(err, ErrNotEligibleSetPassword),
+		errors.Is(err, ErrEmailMismatch):
+		return err.Error(), true
+	default:
+		return "", false
+	}
+}