feat(expenses): add authoritative pre-review workflow

web/tests/api-request.test.mjs

@@ -243,6 +243,44 @@ async function testRejectsWithCustomTimeoutMessage() {
   )
 }
 
+async function testPreservesStructuredPreReviewConflict() {
+  const review = {
+    review_id: 'review-conflict-001',
+    decision: 'needs_fix',
+    message: '住宿费超过标准，请先调整。',
+    findings: [{ risk_id: 'risk-001', severity: 'high' }]
+  }
+  global.fetch = async () => ({
+    ok: false,
+    status: 409,
+    async json() {
+      return {
+        detail: {
+          code: 'PRE_REVIEW_NEEDS_FIX',
+          message: '预审发现需整改风险。',
+          review
+        }
+      }
+    }
+  })
+
+  await assert.rejects(
+    () => apiRequest('/reimbursements/claims/claim-001/submit', {
+      method: 'POST',
+      body: '{}'
+    }),
+    (error) => {
+      assert.equal(error.status, 409)
+      assert.equal(error.code, 'PRE_REVIEW_NEEDS_FIX')
+      assert.equal(error.message, '预审发现需整改风险。')
+      assert.deepEqual(error.review, review)
+      assert.deepEqual(error.detail.review, review)
+      assert.deepEqual(error.payload.detail.review, review)
+      return true
+    }
+  )
+}
+
 async function run() {
   await testUsesCustomContentTypeHeader()
   await testSupportsBlobResponses()
@@ -251,6 +289,7 @@ async function run() {
   await testRejectsCustomAuthorizationOverride()
   await testUnauthorizedResponsePublishesSessionExpiredEvent()
   await testFormatsValidationErrors()
+  await testPreservesStructuredPreReviewConflict()
   await testRejectsWithCustomTimeoutMessage()
   console.log('api-request tests passed')
 }