fix: loan error surfacing, non-admin export, guarded atomic migration, expanded player controls

web/test/item.test.tsx

@@ -25,7 +25,7 @@ vi.mock('../src/api.js', async (importOriginal) => {
   }
 })
 
-import { api } from '../src/api.js'
+import { api, ApiError } from '../src/api.js'
 
 const item: ItemDetail = {
   id: 1,
@@ -227,4 +227,12 @@ describe('ItemPage', () => {
     await userEvent.click(screen.getByRole('button', { name: /mark returned/i }))
     await waitFor(() => expect(api.returnLoan).toHaveBeenCalledWith(9))
   })
+
+  it('lend failure surfaces the inline message', async () => {
+    vi.mocked(api.lendItem).mockRejectedValue(new ApiError(409, 'already_on_loan'))
+    renderItem()
+    await userEvent.type(await screen.findByLabelText(/borrower/i), 'Bob')
+    await userEvent.click(screen.getByRole('button', { name: /^lend$/i }))
+    await waitFor(() => expect(screen.getByText(/already out to someone/i)).toBeTruthy())
+  })
 })