M1: minimal board UI (login, board, cartable)

A functional React/Vite SPA exercising the M1 API end-to-end:
- Zustand auth store (persisted JWT) + a small fetch client that attaches the bearer
  token and logs out on 401.
- LoginPage: sign in, or bootstrap the first owner on first run.
- BoardPage: set org name, create/select a team, create tasks, move them across the
  backlog -> in progress -> in review -> done columns, assign to me, and a cartable panel.
- React Router guards routes on the presence of a token.

Mirrors the integration-tested API contracts exactly. Compiles clean (tsc + vite);
still needs a manual click-through (run the web host + Postgres, or `docker compose up
--build`). dnd-kit drag, TanStack Query, and an orval-generated typed client are M1+
polish — buttons/selects drive task moves for now.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

client/src/lib/api.ts

@@ -0,0 +1,31 @@
+import { useAuth } from '../store/auth'
+
+async function request<T>(method: string, url: string, body?: unknown): Promise<T> {
+  const token = useAuth.getState().token
+  const response = await fetch(url, {
+    method,
+    headers: {
+      'Content-Type': 'application/json',
+      ...(token ? { Authorization: `Bearer ${token}` } : {}),
+    },
+    body: body === undefined ? undefined : JSON.stringify(body),
+  })
+
+  if (response.status === 401) {
+    useAuth.getState().logout()
+  }
+
+  if (!response.ok) {
+    const text = await response.text()
+    throw new Error(`${response.status} ${response.statusText}${text ? `: ${text}` : ''}`)
+  }
+
+  const contentType = response.headers.get('content-type') ?? ''
+  return contentType.includes('application/json') ? ((await response.json()) as T) : (undefined as T)
+}
+
+export const api = {
+  get: <T>(url: string) => request<T>('GET', url),
+  post: <T>(url: string, body?: unknown) => request<T>('POST', url, body),
+  patch: <T>(url: string, body?: unknown) => request<T>('PATCH', url, body),
+}