feat: surface unprocessable state deltas as fatal client errors - #6827

When the backend sends a delta with a substate the frontend has no
dispatch function for (mismatched frontend/backend state definitions),
the frontend now:

- validates the entire delta before dispatching anything, so a bad
  substate no longer partially applies an update or silently drops
  queued events,
- logs an actionable error to the browser console,
- reports the error to the backend via a new client_error socket event
  so it shows up in the terminal where devs look first,
- treats the mismatch as fatal per reflex-dev#6019: no further events are sent
  until the frontend is rebuilt/reloaded, instead of erroring again on
  every interaction.

Unexpected errors while applying a delta are likewise reported to the
backend instead of vanishing as unhandled rejections.

The backend on_client_error handler validates the payload shape,
sanitizes and truncates client-supplied strings before logging, and
only logs at error level for sockets with a linked token. Error type
strings are shared via constants.ClientErrorType, and emit_update
gained debug logging of outgoing substates (guarded by is_debug so the
hot path is unaffected).

Fixes reflex-dev#6019

- Rate-limit error-level client_error logging to 5 entries per SID
  (cleared on disconnect) so a client that links an arbitrary token
  cannot flood backend logs.
- Escape rich markup in sanitized client values; unescaped closing tags
  raised MarkupError and styling tags could inject into terminal logs.
- Keep sanitized values within max_length including the truncation
  suffix.
- Clear the event queue on fatal state mismatch; callers drain the
  queue in while-loops that would otherwise spin forever.
- Await queueEvents inside the event handler try block so failures are
  reported via client_error instead of unhandled rejections; guard
  error.message for non-Error throws.
- Add news fragments for the changelog check.

Per-SID budgets reset when a new socket connects, so scripted
reconnect loops could still flood backend logs. Add a process-wide
time-window cap (20 entries per 60s) on top of the per-SID limit;
later windows log again, so long-lived sessions are not silenced
forever.

- Wire on_client_error into app.frontend_exception_handler so custom
  handlers (e.g. error trackers) receive client-reported errors.
- Reword the frontend mismatch message to suggest refreshing the page
  first, per review.
- Remove the per-update substate debug log (too spammy for --loglevel
  debug).
- Warn once per window when the client_error rate limit trips so
  suppression is never silent.

A stale frontend build is the usual cause of a delta the frontend cannot
dispatch, and a reload picks up the matching one. The reload is recorded
in sessionStorage so a mismatch that survives it (e.g. api_url pointing
at a different app) leaves the page up with the error reported rather
than looping.

Also from review:

- Move _sanitize_client_log_value off EventNamespace into
  format.sanitize_client_log_value, slicing to max_length before the
  per-character scan so an oversized value costs no more than a bounded
  one.
- Sanitize only after the SID and rate-limit checks, so reports that get
  dropped do not pay for it.
- Escape rich markup in FrontendEventExceptionState, where a JS message
  containing square brackets could style backend logs or raise
  MarkupError.
- Validate the delta in a single pass that allocates only on a miss, and
  stop awaiting queueEvents inside the event handler so a delta applies
  in full before a later update can interleave.
- Fold tests/units/test_client_error.py into test_app.py and
  test_format.py, and cover the report and the reload in Playwright.

An automatic reload silently hides the failure this PR exists to surface,
wipes page state to fix only the stale-build case, and in the wrong-api_url
case produces a second identical report under a new SID that reads as a
duplicate. Drop the reload and the sessionStorage once-per-tab guard: a
mismatch now reports exactly once, stops further events, and leaves
recovery (rebuild or api_url fix) to the developer.

Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>