fix(timeline): harden curator event precision field

- Validate the submitted precision against the DatePrecision allow-list in
  parseEventForm (falls back to DAY) so an untrusted token can't flow into
  the request body — symmetric with the existing `type` narrowing.
- Parameterize the precision input name via DatePrecisionField's new
  precisionInputName prop; the timeline form now submits `precision` instead
  of the misleading document-domain `metaDatePrecision`. Document form keeps
  the default, so its behaviour is unchanged.
- Capture EventTypeSelect's onchange into EventForm's `type` state so it no
  longer goes stale (the submitted value was already correct via the hidden
  input; this keeps the local state in sync).

Addresses PR #832 review (#781).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

frontend/src/lib/timeline/EventForm.svelte

@@ -62,7 +62,7 @@ let selectedDocuments = $state<DocumentOption[]>(
 	event?.documents
 		? event.documents.map((d) => ({
 				// Graceful degradation: DocumentRef has no precision fields. formatDocumentOption
-				// falls back to the bare title when documentDate is the only date info present.
+				// defaults a missing precision to DAY, so the chip shows the full documentDate.
 				id: d.id,
 				title: d.title,
 				documentDate: d.documentDate
@@ -196,7 +196,10 @@ async function confirmDelete(e: SubmitEvent) {
 						<span class="mb-1 block text-sm font-medium text-ink-2"
 							>{m.event_editor_type_label()}</span
 						>
-						<EventTypeSelect value={type} name="type" onchange={() => markDirty()} />
+						<EventTypeSelect value={type} name="type" onchange={(t) => {
+								type = t;
+								markDirty();
+							}} />
 					</div>
 
 					<div class="grid grid-cols-1 gap-5 md:grid-cols-2">
@@ -206,6 +209,7 @@ async function confirmDelete(e: SubmitEvent) {
 							bind:endDateIso={endDateIso}
 							dateInputName="eventDate"
 							endDateInputName="eventDateEnd"
+							precisionInputName="precision"
 							dateLabel={m.form_label_date()}
 							dateTestId="event-date"
 							precisionTestId="event-precision"

frontend/src/lib/timeline/eventFormServer.ts

@@ -8,6 +8,20 @@ type TimelineEventRequest = components['schemas']['TimelineEventRequest'];
 // Prevents open redirect: validate before constructing /persons/{id}. See OWASP CWE-601.
 const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 
+// Whitelist of accepted precision tokens — mirrors the DatePrecision union. Any
+// other submitted value falls back to DAY rather than flowing untrusted into the
+// request body (the backend enum is the hard gate; this keeps the two symmetric
+// with the `type` narrowing below).
+const VALID_PRECISIONS: readonly DatePrecision[] = [
+	'DAY',
+	'MONTH',
+	'SEASON',
+	'YEAR',
+	'RANGE',
+	'APPROX',
+	'UNKNOWN'
+];
+
 /**
  * Resolves the context-aware post-save / post-delete redirect target. Returns
  * the originating person page only when `originPersonIdRaw` is a strict UUID;
@@ -33,7 +47,9 @@ export interface ParsedEventForm {
 export function parseEventForm(formData: FormData): ParsedEventForm {
 	const rawType = formData.get('type')?.toString();
 	const type = rawType === 'HISTORICAL' ? 'HISTORICAL' : 'PERSONAL';
-	const precision = (formData.get('metaDatePrecision')?.toString() as DatePrecision) || 'DAY';
+	const rawPrecision = formData.get('precision')?.toString() as DatePrecision | undefined;
+	const precision: DatePrecision =
+		rawPrecision && VALID_PRECISIONS.includes(rawPrecision) ? rawPrecision : 'DAY';
 	const endRaw = formData.get('eventDateEnd')?.toString().trim() ?? '';
 	// Off-RANGE submits an empty string → null so a stale end-date never persists.
 	const eventDateEnd = precision === 'RANGE' && endRaw ? endRaw : null;