feat(electron): error handling foundation

Adds the infrastructure for a coherent client-side error story:

- `lib/errors.ts`: canonical ApiError + QuotaExceededError, `toUserMessage`
  (friendly strings for ApiError/ZodError/network errors, strips Electron
  IPC message prefixes), `logError` (expected), `reportError` (unexpected).
- `lib/query-client.ts`: QueryClient factory with sane retry defaults (no
  retry on 4xx except 408/429, 2 retries otherwise; 0 mutation retries),
  `QueryCache` onError logs + opts in via `meta.toastOnError`, and
  `MutationCache` onError toasts `toUserMessage(err)` by default with
  `meta.suppressToast` as the opt-out.
- `components/app-error-boundary.tsx` + `error-fallback.tsx`: two boundaries
  (top-level outside the router, route-level inside) with a Card-based
  fallback offering 'Go home' + 'Try again'. Route boundary resets on
  pathname change and clears React Query error cache on retry.
- `main/ipc-utils.ts` + main.ts migration: `safeHandle` wraps ipcMain.handle
  so main-process failures log with full stack and surface a sanitized
  message to the renderer. `link:fetch-metadata` keeps its null contract
  but now logs.
- `useCreateParticle` opts out of the global toast (compose-overlay renders
  its own quota UX) so nothing double-toasts.

Render crashes now have a recovery UI, every mutation gets a free error
toast, and silent-catch cleanup + Sentry land in follow-up PRs.

js/src/lib/errors.ts

@@ -0,0 +1,92 @@
+import { z } from "zod";
+import { appEnv } from "@/config/env";
+
+/**
+ * Thrown by the API client for any non-2xx response.
+ */
+export class ApiError extends Error {
+  constructor(
+    public status: number,
+    message: string,
+  ) {
+    super(message);
+    this.name = "ApiError";
+  }
+}
+
+/**
+ * Thrown when a free-plan network attempts to create a non-container particle
+ * after hitting its daily message limit. Callers should surface an upgrade
+ * prompt; compose UI should also disable triggers proactively via
+ * `useNetworkUsage` rather than relying on this throw.
+ */
+export class QuotaExceededError extends Error {
+  constructor(public readonly networkId: string) {
+    super("Daily message limit reached");
+    this.name = "QuotaExceededError";
+  }
+}
+
+const IPC_PREFIX = /^Error invoking remote method '[^']+':\s*/;
+
+function normalizeMessage(message: string): string {
+  return message.replace(IPC_PREFIX, "").replace(/^Error:\s*/, "").trim();
+}
+
+/**
+ * Maps any thrown value to a short, user-facing string. Used by the global
+ * MutationCache toast handler, the error-boundary fallback, and any call site
+ * that wants to surface an error in the UI.
+ */
+export function toUserMessage(err: unknown): string {
+  if (err instanceof ApiError) {
+    if (err.status === 401) return "Please sign in again.";
+    if (err.status === 403) return "You don't have permission to do that.";
+    if (err.status === 404) return "Not found.";
+    if (err.status === 408 || err.status === 429) {
+      return "Please try again in a moment.";
+    }
+    if (err.status >= 500) {
+      return "Something went wrong on our end. Please try again.";
+    }
+    return normalizeMessage(err.message) || "Request failed.";
+  }
+
+  if (err instanceof z.ZodError) {
+    return "Received unexpected data from the server.";
+  }
+
+  if (err instanceof TypeError && /fetch|network/i.test(err.message)) {
+    return "Network error. Check your connection.";
+  }
+
+  if (err instanceof Error) {
+    return normalizeMessage(err.message) || "Something went wrong.";
+  }
+
+  return "Something went wrong.";
+}
+
+type ErrorContext = Record<string, unknown>;
+
+/**
+ * For expected-but-worth-recording failures (silent-catch sites). In dev,
+ * prints to console. In prod today this is a no-op; PR 4 wires this up to
+ * Sentry breadcrumbs without touching call sites.
+ */
+export function logError(err: unknown, context?: ErrorContext): void {
+  if (appEnv === "dev") {
+    // eslint-disable-next-line no-console
+    console.error("[error]", err, context ?? {});
+  }
+}
+
+/**
+ * For unexpected failures the user may not have seen (render crashes, query
+ * errors, background mutations). Always surfaces somewhere. PR 4 wires this
+ * up to `Sentry.captureException`.
+ */
+export function reportError(err: unknown, context?: ErrorContext): void {
+  // eslint-disable-next-line no-console
+  console.error("[error]", err, context ?? {});
+}