chore: standardize security and quality foundations

frontend/app/lib/api-client.test.ts

@@ -0,0 +1,23 @@
+import { describe, expect, it } from "vitest";
+
+import { apiUrl, requestJson } from "./api-client";
+
+describe("api client", () => {
+  it("normalizes relative API paths", () => {
+    expect(apiUrl("health")).toBe("/api/health");
+    expect(apiUrl("/health")).toBe("/api/health");
+  });
+
+  it("returns typed JSON from successful responses", async () => {
+    const transport = async () => new Response(JSON.stringify({ status: "ok" }), { status: 200 });
+    const result = await requestJson<{ status: string }>("/health", undefined, transport);
+    expect(result).toEqual({ status: "ok" });
+  });
+
+  it("uses the API error detail when a request fails", async () => {
+    const transport = async () => new Response(JSON.stringify({ detail: "Not available" }), { status: 409 });
+    await expect(requestJson("/requests/1", undefined, transport)).rejects.toEqual(
+      expect.objectContaining({ status: 409, message: "Not available" }),
+    );
+  });
+});