SPA tests: api/client.ts auth + transparent-refresh flow #107

Follow-up to #105 / PR #106 (survey found this the highest-value untested SPA logic). web/src/api/client.ts carries stateful, security-adjacent auth logic with zero coverage.

Cover (mocked fetch)

• Single-flight refresh — concurrent 401s share one in-flight /auth/refresh (refreshInFlight); second caller does not trigger a second refresh.
• Transparent retry — a 401 → one refresh → original request retried with the new access token → success.
• Refresh failure — refresh 401/throw → clearTokens() + onUnauthenticated() fired, original error rethrown; no infinite retry loop.
• Auth header — Authorization: Bearer <token> attached when a token exists; absent when not.
• Writes force Idempotency-Key — apiPost/apiPut/apiDelete send an Idempotency-Key header; an explicit key overrides the generated crypto.randomUUID().
• parseError — ValidationProblem errors map is flattened into the message; non-JSON body falls back to status text; ApiError.status/title preserved.
• apiGetBlob — same 401→refresh→retry path; 204 → undefined.
• login/logout — login saves tokens + fires onTokensChanged; logout clears locally even when the revoke call fails.

Needs a fetch mock/stub (vi.stubGlobal) and crypto.randomUUID available in jsdom (or stub). Part of #105, epic #14.