fix(tariff): reject stepped base combined with time/seasonal tiers

A stepped ("up-to") default card prices the whole stay as one total, so the V2
engine short-circuits to steppedFee and NEVER consults windowed cards — any
time/seasonal tiers would silently never fire. Found live: an active tariff had a
stepped base plus weekday-night + weekend tiers, and every 3h stay priced 600 ALL
regardless of hour/day because the tiers were dead.

- validateTariffV2 now rejects a stepped defaultCard combined with windowedCards,
  with an actionable message (switch the base to ladder/flat, or remove the tiers).
- Composer shows an inline red warning the moment base mode is stepped and tiers
  exist; publishing is blocked server-side regardless.
- ApiError now carries the server's problems[], so the publish error surfaces the
  SPECIFIC reason instead of a generic "invalid tariff structure".
- 2 new validation tests (55 pass).

Wiki: tariff, log.

Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V

apps/web/src/TariffComposer.tsx

@@ -341,8 +341,8 @@ export function TariffComposer() {
       setMsg({ kind: "ok", text: t("tariff.publishedOk") });
     } catch (e) {
       const text =
-        e instanceof ApiError && (e as ApiError & { problems?: string[] }).problems
-          ? `${e.message}: ${((e as ApiError & { problems?: string[] }).problems ?? []).join("; ")}`
+        e instanceof ApiError && e.problems?.length
+          ? `${e.message}: ${e.problems.join("; ")}`
           : (e as Error).message;
       setMsg({ kind: "err", text });
     } finally {
@@ -404,6 +404,13 @@ export function TariffComposer() {
       <details className="mt-6" open={form.tiers.length > 0}>
         <summary className="cursor-pointer text-h6 font-semibold uppercase tracking-wider text-term-text">{t("tariff.tiersAdvanced")}</summary>
         <p className="hint mt-1.5 mb-2">{t("tariff.tiersHint")}</p>
+        {/* A stepped ("up-to") base rate cannot be combined with time tiers — the
+            engine would ignore them. Warn up-front; publishing is also blocked server-side. */}
+        {form.base.mode === "stepped" && form.tiers.length > 0 && (
+          <p className="mb-3 rounded-term border border-term-red/50 bg-term-red/10 px-3 py-2 text-[12px] text-term-red">
+            {t("tariff.steppedTiersConflict")}
+          </p>
+        )}
         {form.tiers.map((tr, i) => (
           <fieldset key={i} className="card mb-3 p-4">
             <legend className="flex items-center gap-2 px-1">

apps/web/src/api.ts

@@ -29,7 +29,7 @@ export async function apiFetch<T>(path: string, init: RequestInit = {}): Promise
   }
   const res = await fetch(path, { ...init, headers, credentials: "include" });
   if (!res.ok) {
-    const msg = (await res.json().catch(() => ({}))) as { error?: string };
+    const msg = (await res.json().catch(() => ({}))) as { error?: string; problems?: string[] };
     const error = msg.error ?? `${path}: ${res.status}`;
     // Ship the failed request to the backend log store (best-effort, loop-safe — the
     // logger itself never logs the /api/logs call). 401s are normal pre-login churn,
@@ -37,7 +37,7 @@ export async function apiFetch<T>(path: string, init: RequestInit = {}): Promise
     if (res.status !== 401) {
       logFailedRequest({ path, method, status: res.status, error });
     }
-    throw new ApiError(error, res.status);
+    throw new ApiError(error, res.status, msg.problems);
   }
   if (res.status === 204) return undefined as T;
   return res.json() as Promise<T>;
@@ -47,6 +47,8 @@ export class ApiError extends Error {
   constructor(
     message: string,
     readonly status: number,
+    /** Field-level problems from a validation error (e.g. tariff publish), if any. */
+    readonly problems?: string[],
   ) {
     super(message);
   }

apps/web/src/lib/i18n/en.ts

@@ -243,6 +243,8 @@ export const en: Catalog = {
     stepUpTo: "Up to",
     stepTotal: "Total price",
     addStep: "+ Add row",
+    steppedTiersConflict:
+      "⚠ Time/seasonal tiers do NOT apply when the base rate is 'By duration (up-to)' — the engine ignores them entirely. Remove the tiers, or switch the base rate to 'Hourly ladder' or 'Flat price'. Publishing is blocked until this is fixed.",
     tiersAdvanced: "Advanced: time & seasonal tiers",
     tiersHint: "Optional. Add tiers that apply only at certain hours/days/dates or for a category (e.g. happy hour, night rate, weekend, bus). With no tiers, just the base rate is published.",
     tierName: "Name",

apps/web/src/lib/i18n/sq.ts

@@ -246,6 +246,8 @@ export const sq = {
     stepUpTo: "Deri në",
     stepTotal: "Çmimi total",
     addStep: "+ Shto rresht",
+    steppedTiersConflict:
+      "⚠ Nivelet kohore/sezonale NUK zbatohen kur tarifa bazë është 'Sipas kohëzgjatjes (deri-në)' — motori i shpërfill plotësisht. Hiqi nivelet, ose ndrysho tarifën bazë në 'Shkallë orësh' a 'Çmim fiks'. Publikimi bllokohet derisa kjo të rregullohet.",
     tiersAdvanced: "Të avancuara: nivele kohore & sezonale",
     tiersHint: "Opsionale. Shto nivele tarifore që vlejnë vetëm në orë/ditë/data ose kategori të caktuara (p.sh. orë e lirë, tarifë nate, fundjavë, autobus). Pa nivele, publikohet vetëm tarifa bazë.",
     tierName: "Emri",