feat(litigationplanner): primary_party CHECK constraint + IsValidPrimaryParty helper (Slice B3, m/paliad#124 §18.3)

Tightens paliad.deadline_rules.primary_party from free-text to a CHECK
constraint over the canonical four-value vocab (claimant / defendant /
court / both). NULL stays valid for the 78 cross-cutting orphan
concept seeds (Wiedereinsetzung, Versäumnisurteil-Einspruch,
Schriftsatznachreichung, Weiterbehandlung) — they have no
proceeding_type_id binding so they're outside the calculator's path;
loosening the CHECK to "IS NULL OR IN (…)" keeps them valid without
backfill gymnastics.

Migration 135 (audit-first):
  - DO block RAISEs NOTICE for every non-conforming row + RAISEs
    EXCEPTION if any dirty rows exist (manual cleanup required).
    Live audit (Supabase, 2026-05-26 §18.0) confirmed zero dirty rows
    on the current corpus; the audit pass stays in the migration as
    safety against future drift.
  - ALTER TABLE … ADD CONSTRAINT deadline_rules_primary_party_chk
    CHECK (primary_party IS NULL OR primary_party IN
           ('claimant', 'defendant', 'court', 'both'))
  - Post-migration distribution NOTICE so the operator sees the
    final per-value count.
  - Down = DROP CONSTRAINT. No data revert needed.

Package additions (pkg/litigationplanner):
  - PrimaryParty* constants (PrimaryPartyClaimant / Defendant / Court
    / Both) + PrimaryParties[] ordered list + IsValidPrimaryParty(s)
    predicate. Empty string is "no value supplied" = valid (NULL maps
    to empty on the wire); non-empty must match one of the four
    canonical values.
  - Sibling unit tests (primary_party_test.go) pin the four-value
    vocab + the chip order + IsValidAppealTarget's matching shape.

Rule-editor validation hook (rule_editor_service.go):
  - Create() validates input.PrimaryParty before INSERT.
  - UpdateDraft() validates patch.PrimaryParty before UPDATE.
  - Both surface a user-friendly 400 with the canonical vocab listed
    instead of leaking the raw PG CHECK constraint-violation message.
  - Uses errors.Is(err, ErrInvalidInput) so handler 400 routing
    continues to work.

services/fristenrechner.go cleanup:
  - The B2-inlined isValidPartyForLookup helper is replaced with the
    canonical lp.IsValidPrimaryParty. No behaviour change.

No frontend changes — the rule-editor's primary_party UI already
constrains to the four values via a select; the validation hook is
defense-in-depth.

Audit:
  - go build + go test (incl. new lp unit tests) all green
  - Pre-migration audit confirmed: 26 claimant + 26 defendant + 38
    court + 63 both + 78 NULL = 231 total, all in canonical vocab
  - event_categories.party (text[] array, narrower semantic) is
    NOT touched in this migration per the design doc's
    "out of scope, separate follow-up" decision

internal/services/rule_editor_service.go

@@ -13,6 +13,7 @@ import (
 	"github.com/jmoiron/sqlx"
 
 	"mgit.msbls.de/m/paliad/internal/models"
+	lp "mgit.msbls.de/m/paliad/pkg/litigationplanner"
 )
 
 // RuleEditorService owns the admin-only rule lifecycle for Phase 3
@@ -148,6 +149,16 @@ func (s *RuleEditorService) Create(ctx context.Context, input CreateRuleInput, r
 	if strings.TrimSpace(input.Priority) == "" {
 		input.Priority = "mandatory"
 	}
+	// Slice B3 (m/paliad#124 §18.3, mig 135): canonical four-value
+	// primary_party vocab. Pre-validate so the user gets a
+	// user-friendly error before the DB CHECK fires with the raw
+	// constraint-violation message.
+	if input.PrimaryParty != nil && !lp.IsValidPrimaryParty(*input.PrimaryParty) {
+		return nil, fmt.Errorf(
+			"%w: primary_party=%q is not one of %v",
+			ErrInvalidInput, *input.PrimaryParty, lp.PrimaryParties,
+		)
+	}
 	if err := s.validateSpawnNoCycle(ctx, nil, input.SpawnProceedingTypeID, input.ProceedingTypeID); err != nil {
 		return nil, err
 	}
@@ -220,6 +231,19 @@ func (s *RuleEditorService) UpdateDraft(ctx context.Context, id uuid.UUID, patch
 			ErrInvalidLifecycleState, id, current.LifecycleState)
 	}
 
+	// Slice B3 (m/paliad#124 §18.3, mig 135): pre-validate the
+	// patch's primary_party so the user gets a user-friendly error
+	// before the DB CHECK fires with the raw constraint-violation
+	// message. Patch field is *string — nil means "don't change",
+	// dereferenced empty string means "set to NULL" (handled below
+	// in buildPatchSets).
+	if patch.PrimaryParty != nil && !lp.IsValidPrimaryParty(*patch.PrimaryParty) {
+		return nil, fmt.Errorf(
+			"%w: primary_party=%q is not one of %v",
+			ErrInvalidInput, *patch.PrimaryParty, lp.PrimaryParties,
+		)
+	}
+
 	// Spawn cycle guard: if the patch sets spawn_proceeding_type_id,
 	// validate against the global graph BEFORE the UPDATE so we can
 	// surface the cycle clearly instead of relying on a runtime