Fix calendar window overshooting the cached year range

Found by probing the running API; both suites were green and missed it.

CalendarService validated only start_year against the cache, never the window
end. GET /api/calendar/days?start_year=2035&years=4 returned 200 with
end_year=2038, pulling 2036-2038 from the live holidays-library fallback in
app/utils/holidays.py. That fallback does not know the de facto free days, so
Julafton, Nyarsafton and Midsommarafton were reported as ordinary working days
(18 red days per cached year vs 13 per uncached year). Julafton being charged
as a working day was fixed once before; it had reappeared past 2035.

- clamp end_year to max_year; the response now always reports what it returned
- add strict=True to get_swedish_holidays/get_red_days plus UncachedYearError,
  checked before the memo cache, so a strict caller fails loudly rather than
  silently degrading. Non-strict default behaviour is unchanged.
- RedDaysList derived endYear locally as startYear + years - 1, independent of
  the response, so a clamped window rendered phantom empty years. It now takes
  endYear from the backend.

Tests: clamping at and before max_year (service + router), Julafton/Nyarsafton/
Midsommarafton red for every cached year, red-day count consistent across the
served range, and strict-mode raise/pass-through.

Backend 404 -> 414 tests, frontend 704 -> 705.

Known, deliberately not fixed here: AllocationInputLoader builds its holiday map
the same non-strict way over the planning horizon, so it has the same exposure
once the horizon passes 2035. Clamping would silently truncate planning and
raising would break real plans, so it needs a product decision first.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RXMhc9nT6sNz1SL4j8dznL

backend/app/utils/holidays.py

@@ -103,7 +103,22 @@ def _from_library(year: int) -> Dict[datetime.date, str]:
     return dict(sorted(se_holidays.items()))
 
 
-def get_swedish_holidays(year: int) -> Dict[datetime.date, str]:
+class UncachedYearError(RuntimeError):
+    """Raised by a `strict=True` caller when `year` falls outside
+    `swedish_calendar.json`'s range (or the cache file is missing).
+
+    This should never fire in normal operation: callers that pass
+    `strict=True` (currently only `CalendarService`) are expected to clamp
+    their requested window to `cached_year_bounds()` first. Hitting this is
+    therefore a bug in that clamping, not bad user input — fail loudly
+    instead of silently falling back to the `holidays` library, which gives
+    strictly poorer answers for the same dates (missing de facto days like
+    Julafton/Nyårsafton/Midsommarafton) and would defeat the whole point of
+    the cache (see module docstring; §6 offline/deterministic guarantee).
+    """
+
+
+def get_swedish_holidays(year: int, *, strict: bool = False) -> Dict[datetime.date, str]:
     """Get all Swedish public holidays + de facto days + Sundays for a year.
 
     Returns a mapping of date -> Swedish display name. Cached per year;
@@ -111,10 +126,24 @@ def get_swedish_holidays(year: int) -> Dict[datetime.date, str]:
 
     Args:
         year: Calendar year (e.g., 2026)
+        strict: if True, raise `UncachedYearError` instead of silently
+            falling back to the `holidays` library when `year` is outside
+            the cached range. Checked before consulting the per-year cache
+            so a prior non-strict call for the same (uncached) year can
+            never mask a later strict call's check.
 
     Returns:
         Dict mapping datetime.date to holiday name (e.g. "Juldagen", "Julafton")
     """
+    if strict:
+        bounds = cached_year_bounds()
+        if bounds is None or not (bounds[0] <= year <= bounds[1]):
+            where = f"range {bounds[0]}-{bounds[1]}" if bounds is not None else "cache (missing)"
+            raise UncachedYearError(
+                f"Year {year} is outside the cached Swedish calendar {where}; "
+                "refusing to fall back to the live `holidays` library for a strict caller."
+            )
+
     if year in _holiday_cache:
         return _holiday_cache[year]
 
@@ -126,7 +155,7 @@ def get_swedish_holidays(year: int) -> Dict[datetime.date, str]:
     return result
 
 
-def get_red_days(year: int) -> Dict[datetime.date, str]:
+def get_red_days(year: int, *, strict: bool = False) -> Dict[datetime.date, str]:
     """Real red days for `year`: public holidays and de facto days off,
     EXCLUDING ordinary Sundays (the bare "Söndag" marker).
 
@@ -135,9 +164,13 @@ def get_red_days(year: int) -> Dict[datetime.date, str]:
     dropped. Use this (not `get_swedish_holidays`) for red-day cluster
     detection, where a bare weekend must not be conflated with a real
     holiday.
+
+    `strict` is forwarded to `get_swedish_holidays` — see there.
     """
     return {
-        d: name for d, name in get_swedish_holidays(year).items() if name != _SUNDAY_HOLIDAY_NAME
+        d: name
+        for d, name in get_swedish_holidays(year, strict=strict).items()
+        if name != _SUNDAY_HOLIDAY_NAME
     }