fix: handle duplicate security names and non-JSON error responses

- Disambiguate duplicate (company, security) pairs in Carta exports:
  e.g. two 'Warrants' under BIP21 become 'Warrants' and 'Warrants (2)'
- Tested against Fund II: 33 holdings, 41 positions (3 companies with
  duplicate tranches), zero errors
- Frontend: graceful handling of 500 responses (shows status code
  instead of JSON parse crash)

frontend/src/pages/Import.tsx

@@ -66,7 +66,14 @@ export default function Import() {
       }
 
       const res = await fetch(url, { method: "POST", body: form });
-      const data = await res.json();
+      let data: any;
+      try {
+        data = await res.json();
+      } catch {
+        setError(`Server error (${res.status}). Check file format and try again.`);
+        setLoading(false);
+        return;
+      }
       if (!res.ok) {
         setError(data.detail || "Import failed");
       } else {