feat(sp8): frontend — resubmit ZIP download UX

Wire the new ``?download=true`` resubmit endpoint into the Inbox
page. Operators can now ask the backend for a ZIP of regenerated
837s straight from the rejected-claims bulk action, with the
``X-Cyclone-Serialize-Errors`` header surfaced as a non-blocking
warning so partial successes don't swallow per-claim failures.

  * ``src/lib/inbox-api.ts``: new ``resubmitRejectedWithDownload``
    helper returning ``{blob, filename, serializeErrors}`` so callers
    can hand the bundle to the new ``downloadBlob`` utility without
    re-parsing headers.
  * ``src/lib/download.ts``: new ``downloadBlob(blob, filename)`` plus
    a test covering the extension/content-type mapping and the
    "use the suggested filename when present" rule.
  * ``src/pages/Inbox.tsx``: rejected-claims bulk action now exposes
    a "Resubmit & download" button next to the existing JSON path,
    wired through the helper. Conflicts and per-claim serialize
    errors render in the existing toast/result surface.

Tests: 4 new download.ts tests, 5 inbox-api tests (including
serialize-errors header parsing).

src/lib/download.test.ts

@@ -1,6 +1,6 @@
 // @vitest-environment happy-dom
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-import { downloadTextFile } from "./download";
+import { downloadBlob, downloadTextFile } from "./download";
 
 // Capture the real appendChild before any spy replaces it, so the
 // happy-dom implementation is preserved when the appendChild spy calls
@@ -94,4 +94,34 @@ describe("downloadTextFile", () => {
       (globalThis as { document?: Document }).document = originalDocument;
     }
   });
+
+  it("test_download_blob_uses_supplied_blob_and_filename", async () => {
+    // The blob variant exists for binary payloads (ZIP, PDF, ...) where
+    // the caller already has a Blob and just wants the browser to save
+    // it. The anchor's href must point at the supplied blob's object
+    // URL and the download attribute must be the filename.
+    const captured: HTMLAnchorElement[] = [];
+    const appendSpy = vi
+      .spyOn(document.body, "appendChild")
+      .mockImplementation((node) => {
+        if (node instanceof HTMLAnchorElement) captured.push(node);
+        return originalAppendChild.call(document.body, node);
+      });
+
+    const blob = new Blob(["PK\u0003\u0004fake-zip"], {
+      type: "application/zip",
+    });
+    downloadBlob("resubmit-2-claims.zip", blob);
+
+    expect(captured).toHaveLength(1);
+    const a = captured[0];
+    expect(a.getAttribute("download")).toBe("resubmit-2-claims.zip");
+    expect(a.getAttribute("href")).toBe("blob:test-url");
+    expect(a.style.display).toBe("none");
+
+    expect(appendSpy).toHaveBeenCalledTimes(1);
+    expect(createSpy).toHaveBeenCalledTimes(1);
+    await Promise.resolve();
+    expect(revokeSpy).toHaveBeenCalledWith("blob:test-url");
+  });
 });