feat(sp8): frontend — resubmit ZIP download UX

Wire the new ``?download=true`` resubmit endpoint into the Inbox
page. Operators can now ask the backend for a ZIP of regenerated
837s straight from the rejected-claims bulk action, with the
``X-Cyclone-Serialize-Errors`` header surfaced as a non-blocking
warning so partial successes don't swallow per-claim failures.

  * ``src/lib/inbox-api.ts``: new ``resubmitRejectedWithDownload``
    helper returning ``{blob, filename, serializeErrors}`` so callers
    can hand the bundle to the new ``downloadBlob`` utility without
    re-parsing headers.
  * ``src/lib/download.ts``: new ``downloadBlob(blob, filename)`` plus
    a test covering the extension/content-type mapping and the
    "use the suggested filename when present" rule.
  * ``src/pages/Inbox.tsx``: rejected-claims bulk action now exposes
    a "Resubmit & download" button next to the existing JSON path,
    wired through the helper. Conflicts and per-claim serialize
    errors render in the existing toast/result surface.

Tests: 4 new download.ts tests, 5 inbox-api tests (including
serialize-errors header parsing).

src/lib/inbox-api.ts

@@ -124,6 +124,55 @@ export async function resubmitRejected(
   });
 }
 
+/**
+ * Resubmit rejected claims AND ask the backend for a downloadable bundle
+ * of regenerated 837 files (one .x12 per successfully resubmitted claim).
+ *
+ * Returns the raw `Blob` plus the filename the backend suggested in its
+ * `Content-Disposition` header (e.g. `resubmit-3-claims.zip`). Callers
+ * usually pipe both into `downloadTextFile`'s sibling helper for binary
+ * downloads — see `downloadBlob` in `@/lib/download`.
+ *
+ * The endpoint never fails because of a partial bundle — per-claim
+ * serialization errors are surfaced via the `X-Cyclone-Serialize-Errors`
+ * response header (JSON-encoded array) so the UI can show "10
+ * resubmitted, 2 couldn't be regenerated" without parsing the zip. The
+ * returned blob still contains the claims that did serialize.
+ */
+export async function resubmitRejectedWithDownload(
+  claimIds: string[],
+): Promise<{ blob: Blob; filename: string; serializeErrors: Array<{ claim_id: string; reason: string }> }> {
+  if (!isConfigured) throw notConfiguredError();
+  const res = await fetch(
+    joinUrl("/api/inbox/rejected/resubmit?download=true"),
+    {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ claim_ids: claimIds }),
+    },
+  );
+  if (!res.ok) {
+    const detail = await readErrorBody(res);
+    throw new Error(
+      `${res.status} ${res.statusText}${detail ? ` — ${detail}` : ""}`,
+    );
+  }
+  const blob = await res.blob();
+  const cd = res.headers.get("content-disposition") ?? "";
+  const match = /filename="?([^";]+)"?/i.exec(cd);
+  const filename = match?.[1] ?? "resubmit-bundle.zip";
+  const errHeader = res.headers.get("x-cyclone-serialize-errors");
+  let serializeErrors: Array<{ claim_id: string; reason: string }> = [];
+  if (errHeader) {
+    try {
+      serializeErrors = JSON.parse(errHeader);
+    } catch {
+      serializeErrors = [];
+    }
+  }
+  return { blob, filename, serializeErrors };
+}
+
 export function exportInboxCsvUrl(
   lane: "rejected" | "candidates" | "unmatched" | "done_today",
 ): string {