fix(filesharing): convey required vs optional fields to assistive tech

[dobby-coder]

What & why

The recipient attribute-entry form on /fileshare did not clearly communicate field requirements to screenreader users:

• The required email field gave no programmatic or textual signal that it was required (The screenreader does not clearly read out if a field is required or not #268).
• The optional attributes (phone number, date of birth) were not announced as optional (It is not clear that phone number and birthday are optional when using a screenreader #269).

This PR makes required/optional state explicit for both sighted and assistive-technology users, in line with the org-wide WCAG 2.2 AA goal (criteria 1.3.1 Info and Relationships, 3.3.2 Labels or Instructions, 1.4.1 Use of Color).

Changes

Required email field (RecipientSelectionFields.svelte)

• Added aria-required="true" (native required is kept for browser validation).
• Added a visible red asterisk in the label, marked aria-hidden="true" so the required state isn't double-announced (it comes from aria-required).
• Linked the input to the new legend via aria-describedby="required-fields-legend".

Required-fields legend (RecipientSelection.svelte)

• Added a "Fields marked with * are required." legend so the asterisk has an explanation (not color/symbol-only).

Optional attributes (MultiInput.svelte)

• Appended a muted "(optional)" suffix to each attribute label, so the accessible name announces optionality for phone number, date of birth, and full name.

i18n — added encryptPanel.requiredFieldsLegend and attributes.optional keys in both en.json and nl.json.

Tests — added tests/attribute-form-a11y.test.ts (Playwright) asserting the email's aria-required/asterisk/legend wiring and that optional attribute fields expose (optional) in their accessible name.

Verification

• npm run check — 0 errors / 0 warnings
• npm run build — clean
• npx playwright test — 7 passed (3 new a11y tests + existing RSS tests)
• prettier --check + eslint on changed files — clean
• Manual screenshot confirms the legend, red asterisk, and "(optional)" labels render correctly.

Closes #268
Closes #269

[dobby-coder]

Verdict: APPROVE — posted as COMMENT only because GitHub blocks a bot from approving its own PR (dobby-coder[bot] authored and reviewed). Treat this as a sign-off, not withholding. The PR is being flipped to ready-for-review so a maintainer review can gate the merge.

Rules + review gatekeeper pass — clean.

Per-rule check (one Haiku sub-agent per applicable rule) came back clean: WCAG 2.2 AA (1.3.1 / 3.3.2 / 1.4.1 all satisfied — required state via aria-required not color alone, asterisk aria-hidden, textual legend), conventional-commit PR title, tests-required-on-fixes (3 new Playwright a11y tests), Closes #268/Closes #269 keywords, promised-vs-delivered (diff matches the body claim-for-claim), EN/NL i18n parity, and repo conventions (CSS design tokens, email normalization handled upstream in SendButton). Build + full Playwright suite green (7 passed). The default-prs-to-ready flag was a false-fire — draft is the correct intermediate state for the pipeline and is being lifted now.

One non-blocking nit inline (does not block — see approve-when-ready).