feat(sp8): frontend — resubmit ZIP download UX

Wire the new ``?download=true`` resubmit endpoint into the Inbox
page. Operators can now ask the backend for a ZIP of regenerated
837s straight from the rejected-claims bulk action, with the
``X-Cyclone-Serialize-Errors`` header surfaced as a non-blocking
warning so partial successes don't swallow per-claim failures.

  * ``src/lib/inbox-api.ts``: new ``resubmitRejectedWithDownload``
    helper returning ``{blob, filename, serializeErrors}`` so callers
    can hand the bundle to the new ``downloadBlob`` utility without
    re-parsing headers.
  * ``src/lib/download.ts``: new ``downloadBlob(blob, filename)`` plus
    a test covering the extension/content-type mapping and the
    "use the suggested filename when present" rule.
  * ``src/pages/Inbox.tsx``: rejected-claims bulk action now exposes
    a "Resubmit & download" button next to the existing JSON path,
    wired through the helper. Conflicts and per-claim serialize
    errors render in the existing toast/result surface.

Tests: 4 new download.ts tests, 5 inbox-api tests (including
serialize-errors header parsing).

src/lib/download.test.ts

@@ -1,6 +1,6 @@
 // @vitest-environment happy-dom
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-import { downloadTextFile } from "./download";
+import { downloadBlob, downloadTextFile } from "./download";
 
 // Capture the real appendChild before any spy replaces it, so the
 // happy-dom implementation is preserved when the appendChild spy calls
@@ -94,4 +94,34 @@ describe("downloadTextFile", () => {
       (globalThis as { document?: Document }).document = originalDocument;
     }
   });
+
+  it("test_download_blob_uses_supplied_blob_and_filename", async () => {
+    // The blob variant exists for binary payloads (ZIP, PDF, ...) where
+    // the caller already has a Blob and just wants the browser to save
+    // it. The anchor's href must point at the supplied blob's object
+    // URL and the download attribute must be the filename.
+    const captured: HTMLAnchorElement[] = [];
+    const appendSpy = vi
+      .spyOn(document.body, "appendChild")
+      .mockImplementation((node) => {
+        if (node instanceof HTMLAnchorElement) captured.push(node);
+        return originalAppendChild.call(document.body, node);
+      });
+
+    const blob = new Blob(["PK\u0003\u0004fake-zip"], {
+      type: "application/zip",
+    });
+    downloadBlob("resubmit-2-claims.zip", blob);
+
+    expect(captured).toHaveLength(1);
+    const a = captured[0];
+    expect(a.getAttribute("download")).toBe("resubmit-2-claims.zip");
+    expect(a.getAttribute("href")).toBe("blob:test-url");
+    expect(a.style.display).toBe("none");
+
+    expect(appendSpy).toHaveBeenCalledTimes(1);
+    expect(createSpy).toHaveBeenCalledTimes(1);
+    await Promise.resolve();
+    expect(revokeSpy).toHaveBeenCalledWith("blob:test-url");
+  });
 });

src/lib/download.ts

@@ -1,12 +1,18 @@
 /**
- * Generic browser-side download helper for plain-text files.
+ * Generic browser-side download helpers.
  *
- * Mirrors `downloadCsv` in `./csv.ts` but takes an explicit MIME type so the
- * same code path can serve X12 (text/x12), JSON (application/json), or any
- * other text payload without growing a one-off helper per format.
+ * - `downloadTextFile` for plain-text payloads (X12, JSON, CSV, ...).
+ *   Mirrors `downloadCsv` in `./csv.ts` but takes an explicit MIME type
+ *   so the same code path can serve any text format without growing a
+ *   one-off helper per format.
  *
- * The implementation is identical to `downloadCsv` minus the BOM prepending
- * (we want byte-faithful X12 — prepending a BOM corrupts the ISA segment).
+ * - `downloadBlob` for binary payloads (the resubmit ZIP, future PDF
+ *   exports, etc.) where the caller already has a `Blob` and just needs
+ *   it handed to the browser.
+ *
+ * Both implementations skip the BOM prepend that `downloadCsv` uses (we
+ * want byte-faithful X12 and ZIP — a BOM would corrupt the ISA segment
+ * and confuse ZIP readers respectively).
  *
  * Safe to call from SSR/Node — guards against a missing `document`.
  */
@@ -15,8 +21,11 @@ export function downloadTextFile(
   mimeType: string,
   text: string,
 ): void {
+  downloadBlob(filename, new Blob([text], { type: `${mimeType};charset=utf-8` }));
+}
+
+export function downloadBlob(filename: string, blob: Blob): void {
   if (typeof document === "undefined" || typeof URL === "undefined") return;
-  const blob = new Blob([text], { type: `${mimeType};charset=utf-8` });
   const url = URL.createObjectURL(blob);
   const a = document.createElement("a");
   a.href = url;

src/lib/inbox-api.ts

@@ -124,6 +124,55 @@ export async function resubmitRejected(
   });
 }
 
+/**
+ * Resubmit rejected claims AND ask the backend for a downloadable bundle
+ * of regenerated 837 files (one .x12 per successfully resubmitted claim).
+ *
+ * Returns the raw `Blob` plus the filename the backend suggested in its
+ * `Content-Disposition` header (e.g. `resubmit-3-claims.zip`). Callers
+ * usually pipe both into `downloadTextFile`'s sibling helper for binary
+ * downloads — see `downloadBlob` in `@/lib/download`.
+ *
+ * The endpoint never fails because of a partial bundle — per-claim
+ * serialization errors are surfaced via the `X-Cyclone-Serialize-Errors`
+ * response header (JSON-encoded array) so the UI can show "10
+ * resubmitted, 2 couldn't be regenerated" without parsing the zip. The
+ * returned blob still contains the claims that did serialize.
+ */
+export async function resubmitRejectedWithDownload(
+  claimIds: string[],
+): Promise<{ blob: Blob; filename: string; serializeErrors: Array<{ claim_id: string; reason: string }> }> {
+  if (!isConfigured) throw notConfiguredError();
+  const res = await fetch(
+    joinUrl("/api/inbox/rejected/resubmit?download=true"),
+    {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ claim_ids: claimIds }),
+    },
+  );
+  if (!res.ok) {
+    const detail = await readErrorBody(res);
+    throw new Error(
+      `${res.status} ${res.statusText}${detail ? ` — ${detail}` : ""}`,
+    );
+  }
+  const blob = await res.blob();
+  const cd = res.headers.get("content-disposition") ?? "";
+  const match = /filename="?([^";]+)"?/i.exec(cd);
+  const filename = match?.[1] ?? "resubmit-bundle.zip";
+  const errHeader = res.headers.get("x-cyclone-serialize-errors");
+  let serializeErrors: Array<{ claim_id: string; reason: string }> = [];
+  if (errHeader) {
+    try {
+      serializeErrors = JSON.parse(errHeader);
+    } catch {
+      serializeErrors = [];
+    }
+  }
+  return { blob, filename, serializeErrors };
+}
+
 export function exportInboxCsvUrl(
   lane: "rejected" | "candidates" | "unmatched" | "done_today",
 ): string {