feat(test): hermetic hub fake + state-matrix sweep across all pages

The widget suites used to talk to whatever listens on the real
endpoint — results depended on the operator's machine (a running
hub fed real data into a11y/responsive runs and its gRPC channel
timers caused the historic flake). Hardening round:

- HubService.instance is now injectable (debugSetInstance);
  FakeHubService (test/support/fake_hub.dart) answers every member
  the pages touch with healthy-empty defaults and scripts per-RPC
  failures (UNIMPLEMENTED / UNAVAILABLE / detached gate) through a
  GrpcError-shaped fake. Unimplemented members are recorded and
  fail the sweep with the exact list.
- state_matrix_test.dart pins the app-wide invariants for every
  sidebar page x hub condition: healthy => no unreachable claims
  and no raw error text; hub gone => honest unreachable states;
  UNIMPLEMENTED => never 'not reachable' while the sidebar shows
  connected; detached gate => plain-language feature-off state.
- a11y + responsive sweeps now inject the fake (hermetic); the
  6-minute idle-timer drain workaround is gone with the cause.

Real bugs the new sweep caught immediately:
- every data page (store, doctor, audit, approvals, federation)
  folded ANY load failure into 'hub not reachable' — the runs-page
  bug class; they now share HubLoadErrorView, which classifies
  into unreachable / needs-newer-hub / load-failed-with-copyable-
  detail (new generic DE+EN strings)
- the approvals page's hidden tab had no future listener: a load
  failure there surfaced as an uncaught async error
- the audit status bar rendered the raw gRPC error wall verbatim;
  it now shows the classified friendly headline (still selectable)

Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>

lib/data/friendly_error.dart

@@ -217,6 +217,47 @@ FriendlyError? _matchHubPattern(String detail, AppLocalizations l) {
   return null;
 }
 
+/// How a page-level load failure should be presented. Every page
+/// that fetches its content from the hub used to fold ANY failure
+/// into "hub not reachable", which contradicted the sidebar's
+/// green connected dot whenever the hub answered but the RPC
+/// failed (version skew, feature gates, real bugs). The shared
+/// classification keeps "not reachable" reserved for genuine
+/// connection failures.
+enum HubLoadIssue {
+  /// Socket-level failure or gRPC UNAVAILABLE / DEADLINE_EXCEEDED:
+  /// the hub itself cannot be reached.
+  unreachable,
+
+  /// gRPC UNIMPLEMENTED: the hub answered, but its version
+  /// predates the RPC this view needs — connected, just too old.
+  unsupported,
+
+  /// Anything else — show the friendly error with copyable detail.
+  other,
+}
+
+/// Classify a page-load failure (see [HubLoadIssue]).
+HubLoadIssue classifyHubLoadError(Object error) {
+  switch (grpcCodeOf(error)) {
+    case 12: // UNIMPLEMENTED
+      return HubLoadIssue.unsupported;
+    case 4: // DEADLINE_EXCEEDED
+    case 14: // UNAVAILABLE
+      return HubLoadIssue.unreachable;
+  }
+  // Non-gRPC failures: only clear socket-level shapes count as
+  // "unreachable"; everything else keeps its real story.
+  final s = error.toString().toLowerCase();
+  if (s.contains('socketexception') ||
+      s.contains('connection refused') ||
+      s.contains('connection terminated') ||
+      s.contains('failed to connect')) {
+    return HubLoadIssue.unreachable;
+  }
+  return HubLoadIssue.other;
+}
+
 /// Duck-typed `GrpcError.code` reader — public so pages that
 /// classify errors themselves (e.g. the runs monitor separating
 /// "hub down" from "hub too old") share one accessor instead of