M39: harden application and acceptance gates

frontend/src/api/client.ts

@@ -14,11 +14,23 @@ export function onUnauthorized(listener: UnauthorizedListener): () => void {
 
 const DEFAULT_TIMEOUT_MS = 15_000;
 
+/** `AbortSignal.any` with a fallback for browsers that predate it (Safari < 17.4, etc.). */
+function combineSignals(caller: AbortSignal, timeout: AbortSignal): AbortSignal {
+  if (typeof AbortSignal.any === "function") return AbortSignal.any([caller, timeout]);
+  const combined = new AbortController();
+  const forward = (source: AbortSignal) => () => combined.abort(source.reason);
+  if (caller.aborted) combined.abort(caller.reason);
+  else caller.addEventListener("abort", forward(caller), { once: true });
+  if (timeout.aborted) combined.abort(timeout.reason);
+  else timeout.addEventListener("abort", forward(timeout), { once: true });
+  return combined.signal;
+}
+
 async function request<T>(path: string, init?: RequestInit): Promise<T> {
   const timeoutController = new AbortController();
   const timeout = window.setTimeout(() => timeoutController.abort("timeout"), DEFAULT_TIMEOUT_MS);
   const signal = init?.signal
-    ? AbortSignal.any([init.signal, timeoutController.signal])
+    ? combineSignals(init.signal, timeoutController.signal)
     : timeoutController.signal;
   let response: Response;
   try {

frontend/src/api/errorMessages.ts

@@ -19,6 +19,7 @@ export const KNOWN_CODES = new Set([
   "VEHICLE_NOT_FOUND",
   "BOOKING_NOT_FOUND",
   "CUSTOMER_NOT_FOUND",
+  "CUSTOMER_ALREADY_MERGED",
   "ENTITY_NOT_FOUND",
   "EVENT_NOT_FOUND",
   "ISSUE_NOT_FOUND",