phase 0 and 1

src/api/client.ts

@@ -6,6 +6,7 @@
  * changes. Nothing else in the app calls `fetch`.
  */
 
+import { authHeader } from '@/auth/token';
 import type { FiestaEnvelope } from './types';
 
 /**
@@ -147,7 +148,10 @@ async function request<T>(path: string, options: RequestOptions = {}): Promise<T
 
   const init: RequestInit = {
     method,
-    headers: { Accept: 'application/json' },
+    // `authHeader()` is read per request, never captured: sign-in and sign-out
+    // both happen while the app is running, and a header bound once would keep
+    // authorising calls for whoever signed in first.
+    headers: { Accept: 'application/json', ...authHeader() },
     signal: signal ?? null,
   };
 
@@ -204,7 +208,7 @@ async function requestEnvelope<T>(
   const { method = 'GET', params, body } = options;
   const url = `${API_BASE}${path}${toQueryString(params)}`;
 
-  const init: RequestInit = { method, headers: { Accept: 'application/json' } };
+  const init: RequestInit = { method, headers: { Accept: 'application/json', ...authHeader() } };
   if (body !== undefined) {
     init.headers = { ...init.headers, 'Content-Type': 'application/json' };
     init.body = JSON.stringify(body);

src/api/types.ts

@@ -33,6 +33,17 @@ export interface FiestaEnvelope<T> {
   data?: T;
   /** Present on the tenant login endpoints. */
   tenantform?: boolean;
+  /**
+   * The console session, issued by the login endpoints only.
+   *
+   * Sits beside `details` rather than inside it because it is not a fact about
+   * the user — it is what proves the request is theirs. Every later call sends
+   * it as `Authorization: Bearer`, and `middleware.WebAuth` reads the tenant out
+   * of it instead of believing the one on the query string.
+   */
+  token?: string;
+  /** Unix seconds. The tab closing normally ends the session well before this. */
+  tokenexpiresat?: number;
 }
 
 /* ────────────────────────────────────────────────────────────────────────────