feat: add customer portal and RTC voice diagnostics

internal/app/app.go

@@ -173,7 +173,13 @@ func Run(ctx context.Context, serviceName string) error {
 				return fmt.Errorf("create per-device secret resolver: %w", err)
 			}
 		} else {
-			deviceSecretResolver = deviceauth.StaticSecretResolver{"local-dev://simulated-terminal-1": []byte(cfg.DeviceLocalSecret)}
+			// The local environment provides one already-bound simulator and one
+			// unbound simulator so the family portal's one-time claim flow can be
+			// exercised without provisioning production device secrets.
+			deviceSecretResolver = deviceauth.StaticSecretResolver{
+				"local-dev://simulated-terminal-1": []byte(cfg.DeviceLocalSecret),
+				"local-dev://unbound-terminal-2":   []byte(cfg.DeviceLocalSecret),
+			}
 		}
 		deviceVerifier, err = deviceauth.NewVerifier(
 			deviceIdentityRepository,

internal/orchestration/provider_processing.go

@@ -7,6 +7,7 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"log/slog"
 	"time"
 
 	"data-terminal-cloud/internal/billing"
@@ -167,6 +168,10 @@ func (p *StartProcessor) Handle(ctx context.Context, event outbox.Event) error {
 				}
 				return outbox.Retryable(err)
 			}
+			slog.ErrorContext(ctx, "provider voice chat start rejected",
+				"provider", providerName,
+				"error", err,
+			)
 			return p.failRejectedStart(ctx, event.AggregateID, tenantID, "provider_start_rejected", "provider permanently rejected voice chat start")
 		}
 	}

internal/voiceprovider/volcengine.go

@@ -283,12 +283,19 @@ func (c *VolcengineClient) call(ctx context.Context, operation, action string, i
 	if readErr != nil {
 		return &Error{Operation: operation, Temporary: true, Cause: readErr}
 	}
+	var result volcengineResponse
+	decodeErr := json.Unmarshal(responseBody, &result)
 	if response.StatusCode < 200 || response.StatusCode >= 300 {
+		if decodeErr == nil && result.ResponseMetadata.Error != nil {
+			providerError := result.ResponseMetadata.Error
+			return &Error{Operation: operation, StatusCode: response.StatusCode,
+				Code: providerError.Code, Temporary: temporaryHTTPStatus(response.StatusCode) || temporaryProviderCode(providerError.Code),
+				Cause: errors.New(providerError.Message)}
+		}
 		return &Error{Operation: operation, StatusCode: response.StatusCode,
 			Temporary: temporaryHTTPStatus(response.StatusCode), Cause: errors.New(http.StatusText(response.StatusCode))}
 	}
-	var result volcengineResponse
-	if err := json.Unmarshal(responseBody, &result); err != nil {
+	if decodeErr != nil {
 		return &Error{Operation: operation, Temporary: true, Cause: errors.New("provider returned invalid JSON")}
 	}
 	if result.ResponseMetadata.Error != nil {

internal/voiceprovider/volcengine_test.go

@@ -89,6 +89,23 @@ func TestVolcengineClientClassifiesRateLimitAndDuplicateStart(t *testing.T) {
 	}
 }
 
+func TestVolcengineClientPreservesProviderErrorOnNonSuccessHTTPStatus(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(writer http.ResponseWriter, _ *http.Request) {
+		writer.WriteHeader(http.StatusNotFound)
+		_ = json.NewEncoder(writer).Encode(map[string]any{"ResponseMetadata": map[string]any{"Error": map[string]any{
+			"Code": "InvalidParameter.AppId", "Message": "application was not found",
+		}}})
+	}))
+	defer server.Close()
+	client := newTestVolcengineClient(t, server.URL)
+	_, err := client.Start(context.Background(), StartRequest{
+		TaskRef: "task-1", RoomID: "room-1", DeviceUserID: "device-1", AgentUserID: "agent-1", EngineMode: "s2s_hybrid",
+	})
+	if err == nil || !strings.Contains(err.Error(), "InvalidParameter.AppId") || !strings.Contains(err.Error(), "application was not found") {
+		t.Fatalf("provider error details were lost: %v", err)
+	}
+}
+
 func TestVolcengineClientRejectsUneditedExampleTemplate(t *testing.T) {
 	_, err := NewVolcengineClient(VolcengineOptions{
 		BaseURL: "https://rtc.volcengineapi.com", AccessKeyID: strings.Repeat("a", 32), SecretAccessKey: strings.Repeat("s", 40),