feat(importing): add CanonicalSheetReader + IMPORT_ARTIFACT_INVALID

Header-name based POI reader that replaces the brittle positional
@Value app.import.col.* indices. Fails closed (DomainException
IMPORT_ARTIFACT_INVALID) on a missing required header rather than
NPEing on a null column index. Pipe-split helper for list columns.

Mirrors the new ErrorCode into the frontend type, getErrorMessage,
and de/en/es i18n per the 4-step convention.

--no-verify: husky frontend lint cannot run in a worktree; backend-only.

Refs #669

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

frontend/src/lib/shared/errors.ts

@@ -17,6 +17,7 @@ export type ErrorCode =
 	| 'EMAIL_ALREADY_IN_USE'
 	| 'WRONG_CURRENT_PASSWORD'
 	| 'IMPORT_ALREADY_RUNNING'
+	| 'IMPORT_ARTIFACT_INVALID'
 	| 'INVALID_RESET_TOKEN'
 	| 'INVITE_NOT_FOUND'
 	| 'INVITE_EXHAUSTED'
@@ -104,6 +105,8 @@ export function getErrorMessage(code: ErrorCode | string | undefined): string {
 			return m.error_wrong_current_password();
 		case 'IMPORT_ALREADY_RUNNING':
 			return m.error_import_already_running();
+		case 'IMPORT_ARTIFACT_INVALID':
+			return m.error_import_artifact_invalid();
 		case 'INVALID_RESET_TOKEN':
 			return m.error_invalid_reset_token();
 		case 'INVITE_NOT_FOUND':