feat(errors): per-account error modal with persisted error list

Accounts finishing done_with_errors showed only a count and a single
last_error. This adds a modal listing every concrete error of the
account's most recent run.

- migration 0005: account_errors table (kind folder|message|account,
  folder, message_ref, error, created_at; ON DELETE CASCADE; indexed)
- store: AddAccountError / ClearAccountErrors / ListAccountErrors
- copy: OnError callback captures per-message error text (previously
  only counted), with a "UID N: subject" reference
- orchestrator: clear errors at run start; persist folder/message/
  account errors; cap 500 rows/account/run with a suppressed-note row
- api: GET /api/tasks/{id}/accounts/{accountId}/errors
- web: AccountErrorsModal, clickable ERRORS count, api + styles

Verified: migration applies on Postgres 18; store add/list/clear and
cascade tests pass against real pg; backend build/vet/test green; web
tsc+vite build and oxlint clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01U9Eq4JtWjyNTv5qat3B3mM

internal/httpapi/accounts.go

@@ -226,6 +226,31 @@ func (s *Server) handleProbeAccountFolders(w http.ResponseWriter, r *http.Reques
 	})
 }
 
+// handleListAccountErrors returns the individual errors recorded for an account
+// during its most recent run, for the per-account error modal.
+func (s *Server) handleListAccountErrors(w http.ResponseWriter, r *http.Request) {
+	taskID, err := pathID(r, "id")
+	if err != nil {
+		http.Error(w, "bad id", http.StatusBadRequest)
+		return
+	}
+	accID, err := pathID(r, "accountId")
+	if err != nil {
+		http.Error(w, "bad account id", http.StatusBadRequest)
+		return
+	}
+	if _, ok := s.findAccount(r, taskID, accID); !ok {
+		http.Error(w, "account not found", http.StatusNotFound)
+		return
+	}
+	errs, err := s.store.ListAccountErrors(r.Context(), accID)
+	if err != nil {
+		http.Error(w, err.Error(), http.StatusInternalServerError)
+		return
+	}
+	writeJSON(w, http.StatusOK, errs)
+}
+
 // handleSetAccountFolderMapping persists one account's rename map + excluded set.
 func (s *Server) handleSetAccountFolderMapping(w http.ResponseWriter, r *http.Request) {
 	taskID, err := pathID(r, "id")