feat(web): generated OpenAPI types + typed openapi-fetch client with 401 redirect

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

web/src/api/auth-redirect.ts

@@ -0,0 +1,7 @@
+/** Hard-navigate to login. Isolated so it can be spied/mocked in tests and swapped
+ *  for a router navigation if needed. */
+export function redirectToLogin(): void {
+  if (window.location.pathname !== "/login") {
+    window.location.assign("/login");
+  }
+}

web/src/api/client.ts

@@ -0,0 +1,18 @@
+import createClient, { type Middleware } from "openapi-fetch";
+
+import type { paths } from "./schema";
+import { redirectToLogin } from "./auth-redirect";
+
+const onUnauthorized: Middleware = {
+  async onResponse({ response }) {
+    if (response.status === 401) {
+      redirectToLogin();
+    }
+
+    return response;
+  },
+};
+
+export const api = createClient<paths>({ credentials: "include" });
+
+api.use(onUnauthorized);