feat: add branded error pages

backend/workflows/templates/workflows/developer_handbook.html

@@ -185,9 +185,10 @@ docker compose exec -T web python manage.py check</code></pre>
       <ol>
         <li>Preserve behavior while refactoring.</li>
         <li>Prefer shared components over page-local special cases.</li>
-        <li>Do not overwrite environment-specific runtime config as a side effect of code deploys.</li>
-        <li>Keep code-driven behavior and data-driven behavior mentally separate.</li>
-        <li>Update documentation in the same branch when operational workflow changes.</li>
+      <li>Do not overwrite environment-specific runtime config as a side effect of code deploys.</li>
+      <li>Keep code-driven behavior and data-driven behavior mentally separate.</li>
+      <li>Update documentation in the same branch when operational workflow changes.</li>
+      <li>Keep branded error handling wired through the root URL handlers so production does not fall back to Django default error pages.</li>
       </ol>
     </div>
     <div class="box">
@@ -557,6 +558,9 @@ make backup-verify BACKUP_DIR=backups/backup_YYYYmmdd_HHMMSS</code></pre>
     <div class="note">
       The LAN test deployment intentionally uses <code>DJANGO_DEBUG=1</code> in <code>.env.test</code> because the security checks correctly reject insecure cookie settings when <code>DEBUG=0</code> and the deployment is still plain HTTP behind a local test topology. This is acceptable for the test box only. Production must run with HTTPS and <code>DEBUG=0</code>.
     </div>
+    <div class="note">
+      If you still want branded wrong-URL and permission pages on the LAN test server while keeping <code>DJANGO_DEBUG=1</code>, enable <code>FORCE_BRANDED_ERROR_PAGES=1</code> in <code>.env.test</code>. Full branded <code>500</code> behavior still requires <code>DEBUG=0</code>, which remains the correct production-style setup.
+    </div>
 
     <h2 id="deploy">18) Deployment</h2>
     <h3>Test server stack</h3>

backend/workflows/templates/workflows/errors/error_page.html

@@ -0,0 +1,31 @@
+{% extends 'workflows/base_shell.html' %}
+{% load i18n %}
+
+{% block title %}{{ error_title }}{% endblock %}
+
+{% block shell_body %}
+  {% include 'workflows/includes/app_header.html' with header_show_home=1 header_inside_shell=1 %}
+  <div class="page-stack">
+    <section class="surface-card" style="max-width: 760px; margin: 0 auto;">
+      <div class="surface-head">
+        <div>
+          <div class="eyebrow">{% trans "Fehlerseite" %}</div>
+          <h1>{{ error_heading }}</h1>
+          <p class="sub">{{ error_message }}</p>
+        </div>
+        <div class="app-stat-card" style="min-width: 120px; text-align: center;">
+          <strong style="font-size: 2rem; line-height: 1;">{{ error_code }}</strong>
+          <span>{% trans "Status" %}</span>
+        </div>
+      </div>
+      <div class="app-action-row">
+        <a class="btn btn-primary" href="/">{% trans "Zur Startseite" %}</a>
+        {% if request.user.is_authenticated %}
+        <a class="btn btn-secondary" href="/requests/">{% trans "Zum Dashboard" %}</a>
+        {% else %}
+        <a class="btn btn-secondary" href="/accounts/login/">{% trans "Anmelden" %}</a>
+        {% endif %}
+      </div>
+    </section>
+  </div>
+{% endblock %}