Route web/src/api modules through shared apiFetch so Bearer headers,
typed error envelopes, and GET/HEAD transient retries live in one place
without swallowing domain failures used by existing error cards.
Prevent login-page 401 noise by deferring project/chat API calls until auth is confirmed, use public-config for registration policy, and add client-side duty assignment checks before saving workflow plans.
Co-authored-by: Cursor <cursoragent@cursor.com>