Show Core errors in the console language

[SaladDay]

What

Every failure the console shows, read or write, now goes through the one shared helper, coreError(error, t). Catalogued Core codes get their bilingual copy. Other codes show Core's English message in English and name the code in Chinese. A failure without a code names its HTTP status, and one that never reached Core uses the console's own words. Pages that wrap a reason in their own sentence ("无法加载 Item：…") keep that sentence and pass coreError as the reason.

Call sites that used to show error.message and now use coreError:

• Overview load toast: the per-page errorText and its string state are gone. The overview hook returns failed, and the toast detail is readFailure.unknown. isGatewayOrNetworkFailure now classifies the error itself instead of matching message text.
• Session page: Items/Turns read failures, the stale-refresh toast and the load-failed empty state. session-history keeps the raw rejection reasons instead of strings.
• Session delete dialog: a refusal keeps the AgentCoreError and shows delete.rejected with coreError.
• Session runtime: the observation read failure.
• Executor credentials: the read failure, write-refusal toasts and the rotation error. The refusal outcome carries the AgentCoreError instead of a string.
• Delete flows (useDeleteFlow, used by Agents, Environment templates, Skills, Files and Vaults): the refusal shown in the confirm dialog.
• Vaults: the vault and credential read failures. Agents and Environment templates: the detail read failure.
• Skills: coreErrorMessage is deleted, and every Skill detail failure uses coreError.
• Files: the unused classifyFilesListError/filesErrorReason mapping and its files.errors.* keys are deleted.
• Settings default models, Core metrics, Sandbox metrics hosted runtimes, Agent metrics (metrics and key usage) and the node host detail: their read failures.
• API key flows: a refusal carries the AgentCoreError, and the dialog shows errors.rejected with coreError, so code-less or param-less refusals no longer show raw English in zh.
• Sandbox requests (sandboxRequestError): a refusal outside the catalog now follows coreError instead of a fixed "request was rejected" sentence, so the console says which code Core refused with. The now-unused zh sandbox key is deleted.

sandboxConfigurationRejection (lib/sandbox-labels.ts) kept a fallback to Core's raw message for sandbox_configuration_error. That code is catalogued, so the fallback never ran. It now returns the catalogued reason only.

Left alone on purpose:

• session-diagnostics.tsx shows API content and belongs to Fail Turns when the model host is unreachable #704.
• The removal_unconfirmed sentinel and RuntimeDurableHistoryIncompleteError already map to localized keys.
• Project failures, workspace storage, model provider, node edit and enrollment, and console access already route through coreError, coreFieldError or localized auth errors.
• The overview network check reads TypeError.message only to classify the error, never to show it.

Why

The zh console showed Core's raw English error text on many pages, because each page rendered error.message itself. One helper keeps the rule in one place.

Verification

• pnpm --filter @oac/web typecheck: passed (also after the rebase onto Fail Turns when the model host is unreachable #704).
• vitest run on the touched tests (key-flows, file-operations, project-sessions, overview-loader, overview-model, executor-credential-ownership, session-history, locale, core-error): 9 files, 62 tests passed. The executor credentials zh test now asserts that a failed read names the code (Core 请求失败（credential_store_unavailable）。) and not Core's English message.
• Playwright with the bundled Chromium headless shell on ports 18108/4288: resources, overview-readiness, provider-observations, request-log, sandbox-reset, monitoring, system, nodes, unified-settings, sandbox-generation, projects, public-url and diagnostics. 81 tests passed. resources.spec now injects its deletion refusal with code: "conflict_error", as real Core sends one.
• Fixture console at 1440 px, zh and en:
  • An Agent deletion refused with an uncatalogued code shows "Core 请求失败（conflict_error）。" in zh, where it used to show the English message. en still shows Core's message.
  • A Session whose Items read fails with internal_error shows "无法加载 Item：Core 未能完成请求。" in zh.
• make check-names and make check-docs: passed.

Skipped

• Full make check: focused checks only.
• Go checks: no Go change.
• 390 px screenshots: the change is text only.

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}