Expose explicit duplicate conflicts only where silent handling is incorrect

[dgee2]

Summary

Update endpoints that should not silently absorb duplicates because the duplicate carries distinct business meaning.

Scope

• Add explicit validation/conflict behavior for identified cases
• Update API contracts/OpenAPI only where needed
• Update frontend generated client or consumers only if API-visible behavior changes

Deliverables

• Endpoint-specific explicit duplicate handling
• Contract/OpenAPI updates where required
• Tests covering conflict/validation responses

Acceptance criteria

• Only business-significant duplicate cases become client-visible
• API changes are limited to justified scenarios
• Frontend changes are restricted to impacted endpoints

Testing

• Integration tests for explicit conflict/validation responses
• Frontend/service tests only for endpoints whose duplicate behavior becomes API-visible

Dependencies

• Depends on the duplicate-handling policy sub-issue

Parent: #887

[dgee2]

Triage: squad:basher

This is API contract work with clear business logic. Backend ownership — Basher should handle the endpoint-specific validation, contract updates, and integration tests. Part of the duplicate-handling epic decomposition.