feat: align RU validation, error contract, and generator runtime templates

Wire DSL-derived field labels, safe API error JSON (string|string[]), decimal/enum DTO fixes, and client dataProvider without comma-splitting. Add generation/templates/runtime as canonical source copied on generate; extend AID bundle, prompts, validation gate, and docs.

tools/validate-generation.mjs

@@ -135,6 +135,10 @@ function validateBuildChecks() {
     'prompts/frontend-rules.md',
     'prompts/runtime-rules.md',
     'prompts/validation-rules.md',
+    'generation/templates/runtime/main.ts',
+    'generation/templates/runtime/api-exception.filter.ts',
+    'generation/templates/runtime/dataProvider.ts',
+    'generation/templates/runtime/AppNotification.tsx',
   ]);
 
   const dslFiles = getDslFiles(rootDir).map((filePath) => path.relative(rootDir, filePath).replaceAll('\\', '/'));
@@ -240,6 +244,38 @@ function validateAuthChecks() {
   assertCondition(/protocol\/openid-connect\/certs/.test(authService), 'Backend auth must keep Keycloak certs fallback resolution');
 }
 
+function validateApiErrorContractChecks() {
+  requireFiles([
+    'server/src/common/field-labels.generated.ts',
+    'server/src/common/filters/api-exception.filter.ts',
+  ]);
+  requireContent(
+    'server/src/main.ts',
+    /field-labels\.generated/,
+    'main.ts must import DSL-generated FIELD_LABELS',
+  );
+  requireContent(
+    'server/src/common/filters/api-exception.filter.ts',
+    /message:\s*string\s*\|\s*string\[\]/,
+    'Error JSON must allow message: string | string[]',
+  );
+  requireContent(
+    'server/src/common/filters/api-exception.filter.ts',
+    /Внутренняя ошибка сервера/,
+    'Unexpected server errors must use a generic user-facing message',
+  );
+  requireContent(
+    'client/src/dataProvider.ts',
+    /ApiErrorBody/,
+    'dataProvider must document API error payload shape (ApiErrorBody)',
+  );
+  const dataProviderSource = read('client/src/dataProvider.ts');
+  assertCondition(
+    !dataProviderSource.includes(".split(', ')"),
+    'dataProvider must not split API error strings on comma+space (breaks messages that contain commas)',
+  );
+}
+
 function validateNaturalKeyChecks() {
   const summary = parseJson('domain-summary.json');
   if (!summary) {
@@ -484,6 +520,7 @@ function validateRuntimeExecutionChecks() {
 
 validateBuildChecks();
 validateAuthChecks();
+validateApiErrorContractChecks();
 validateNaturalKeyChecks();
 validateRealmChecks();
 validateRuntimeContractChecks();