feat(persons): add transcriber triage view at /persons/review

New WRITE-gated triage route lists provisional persons (one PersonReviewRow
each) with Merge (reuses POST /merge), Umbenennen (PUT), Bestätigen
(PATCH /confirm) and Löschen (DELETE behind the focus-trapped, Escape-dismissible
ConfirmDialog service). Actions run as form actions via use:enhance so they work
without JS and stay server-side permission-guarded; the loader is READ_ALL.

Refs #667

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

frontend/src/routes/persons/review/+page.server.ts

@@ -0,0 +1,109 @@
+import { error, fail } from '@sveltejs/kit';
+import { createApiClient, extractErrorCode } from '$lib/shared/api.server';
+import { getErrorMessage } from '$lib/shared/errors';
+
+const PAGE_SIZE = 50;
+
+export async function load({ url, fetch, locals }) {
+	const canWrite =
+		(locals.user as { groups?: { permissions: string[] }[] } | undefined)?.groups?.some((g) =>
+			g.permissions.includes('WRITE_ALL')
+		) ?? false;
+
+	const page = Math.max(0, Number.parseInt(url.searchParams.get('page') ?? '0', 10) || 0);
+	const api = createApiClient(fetch);
+
+	const result = await api.GET('/api/persons', {
+		params: { query: { provisional: true, review: true, page, size: PAGE_SIZE } }
+	});
+
+	if (!result.response.ok) {
+		throw error(result.response.status, getErrorMessage(undefined));
+	}
+
+	const data = result.data!;
+
+	return {
+		persons: data.items,
+		totalElements: data.totalElements,
+		totalPages: data.totalPages,
+		pageNumber: data.pageNumber,
+		canWrite
+	};
+}
+
+export const actions = {
+	confirm: async ({ request, fetch }) => {
+		const id = (await request.formData()).get('id') as string;
+		const api = createApiClient(fetch);
+		const result = await api.PATCH('/api/persons/{id}/confirm', {
+			params: { path: { id } }
+		});
+		if (!result.response.ok) {
+			return fail(result.response.status, {
+				error: getErrorMessage(extractErrorCode(result.error))
+			});
+		}
+		return { success: true };
+	},
+
+	delete: async ({ request, fetch }) => {
+		const id = (await request.formData()).get('id') as string;
+		const api = createApiClient(fetch);
+		const result = await api.DELETE('/api/persons/{id}', {
+			params: { path: { id } }
+		});
+		if (!result.response.ok) {
+			return fail(result.response.status, {
+				error: getErrorMessage(extractErrorCode(result.error))
+			});
+		}
+		return { success: true };
+	},
+
+	merge: async ({ request, fetch }) => {
+		const formData = await request.formData();
+		const id = formData.get('id') as string;
+		const targetPersonId = formData.get('targetPersonId') as string;
+		if (!targetPersonId) {
+			return fail(400, { error: getErrorMessage('INVALID_INPUT') });
+		}
+		const api = createApiClient(fetch);
+		const result = await api.POST('/api/persons/{id}/merge', {
+			params: { path: { id } },
+			body: { targetPersonId }
+		});
+		if (!result.response.ok) {
+			return fail(result.response.status, {
+				error: getErrorMessage(extractErrorCode(result.error))
+			});
+		}
+		return { success: true };
+	},
+
+	rename: async ({ request, fetch }) => {
+		const formData = await request.formData();
+		const id = formData.get('id') as string;
+		const firstName = (formData.get('firstName') as string)?.trim() || undefined;
+		const lastName = (formData.get('lastName') as string)?.trim();
+		const personType = (formData.get('personType') as string) || 'PERSON';
+		if (!lastName) {
+			return fail(400, { error: getErrorMessage('INVALID_INPUT') });
+		}
+		const api = createApiClient(fetch);
+		const result = await api.PUT('/api/persons/{id}', {
+			params: { path: { id } },
+			body: {
+				firstName,
+				lastName,
+				personType: personType as 'PERSON' | 'INSTITUTION' | 'GROUP' | 'UNKNOWN'
+			}
+		});
+		if (!result.response.ok) {
+			return fail(result.response.status, {
+				error: getErrorMessage(extractErrorCode(result.error))
+			});
+		}
+		return { success: true };
+	}
+};

frontend/src/routes/persons/review/+page.svelte

@@ -0,0 +1,56 @@
+<script lang="ts">
+import { page } from '$app/state';
+import { SvelteURLSearchParams } from 'svelte/reactivity';
+import { m } from '$lib/paraglide/messages.js';
+import BackButton from '$lib/shared/primitives/BackButton.svelte';
+import Pagination from '$lib/shared/primitives/Pagination.svelte';
+import PersonReviewRow from '$lib/person/PersonReviewRow.svelte';
+
+let { data, form } = $props();
+
+function buildPageHref(targetPage: number): string {
+	const params = new SvelteURLSearchParams(page.url.searchParams);
+	params.set('page', String(targetPage));
+	return `/persons/review?${params.toString()}`;
+}
+
+const hasResults = $derived(data.persons.length > 0);
+</script>
+
+<svelte:head>
+	<title>{m.persons_review_heading()}</title>
+</svelte:head>
+
+<div class="mx-auto max-w-4xl px-4 py-12 sm:px-6 lg:px-8">
+	<BackButton />
+
+	<div class="mt-4 mb-8 border-b border-ink/10 pb-6">
+		<h1 class="font-serif text-3xl font-medium text-ink">{m.persons_review_heading()}</h1>
+		<p class="mt-2 font-sans text-sm text-ink-2">{m.persons_review_intro()}</p>
+	</div>
+
+	{#if form?.error}
+		<p
+			class="mb-4 rounded border border-red-200 bg-red-50 px-3 py-2 text-sm text-red-600"
+			role="alert"
+		>
+			{form.error}
+		</p>
+	{/if}
+
+	{#if !hasResults}
+		<div
+			class="flex flex-col items-center justify-center rounded-lg border border-dashed border-line bg-surface py-16 text-center"
+		>
+			<p class="font-serif text-lg text-ink">{m.persons_review_empty()}</p>
+		</div>
+	{:else}
+		<ul class="flex flex-col gap-3">
+			{#each data.persons as person (person.id)}
+				<PersonReviewRow person={person} />
+			{/each}
+		</ul>
+
+		<Pagination page={data.pageNumber} totalPages={data.totalPages} makeHref={buildPageHref} />
+	{/if}
+</div>