fix(ux): modal error dialog for server-refused actions + ESC closes only the topmost

- Duplicate-tag create/rename hit the uq_tags_user_name constraint and 500'd; now caught and
  returned as a clear 409 ('You already have a tag named …').
- New global error dialog (errorDialog store + ErrorDialog modal) for definitive server refusals;
  the api layer wiring + mount land with the rest of the round.
- Modal now keeps a stack so ESC dismisses only the top modal — an error over the tag editor
  closes the error and leaves the editor open.

frontend/src/lib/errorDialog.ts

@@ -0,0 +1,38 @@
+import i18n from "../i18n";
+
+// A single, self-explanatory error dialog (modal) the user must acknowledge — used when the
+// server can't carry out an action (a definitive 4xx/5xx response). Distinct from toasts
+// (transient, e.g. connection blips) and from silent handling. Module-level so the non-React
+// api layer can raise it; an <ErrorDialog> mounted at the app root renders the current one.
+export interface AppError {
+  title: string;
+  message: string;
+}
+
+let current: AppError | null = null;
+let listeners: Array<() => void> = [];
+const emit = () => listeners.forEach((l) => l());
+
+export function reportError(message?: string, title?: string): void {
+  current = {
+    title: title || i18n.t("errors.title"),
+    message: message || i18n.t("errors.generic"),
+  };
+  emit();
+}
+
+export function dismissError(): void {
+  current = null;
+  emit();
+}
+
+export function subscribeError(listener: () => void): () => void {
+  listeners.push(listener);
+  return () => {
+    listeners = listeners.filter((l) => l !== listener);
+  };
+}
+
+export function getError(): AppError | null {
+  return current;
+}