fix: adding a found subscription sends its membership id (adopt 400 invalid_body)

membershipReconcile.adopt passed { membership_id } as request options, so
no body was sent. useApi now refuses any option other than body, params or
signal, so a payload in the wrong place fails loudly in the browser instead
of as a 400 from the server.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LVjrnpQjRgHdvq95rASoiR

frontend/test/composables/useApi.spec.js

@@ -0,0 +1,37 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+
+import { useApi } from '../../src/composables/useApi.js'
+
+// 2026-09-24: `api.post(url, { membership_id })` shipped in the Subscriptions
+// "Add subscription" button. It reads naturally, sends NO body, and the
+// server's `invalid_body` made the bug look like the backend's. The wrapper now
+// refuses an option it does not know, so the mistake names itself.
+describe('useApi', () => {
+  afterEach(() => { vi.unstubAllGlobals() })
+
+  function stubFetch () {
+    const fetch = vi.fn().mockResolvedValue({
+      ok: true, status: 200, statusText: 'OK', text: () => Promise.resolve('{}'),
+    })
+    vi.stubGlobal('fetch', fetch)
+    return fetch
+  }
+
+  it('refuses a payload passed as options instead of under body', async () => {
+    const fetch = stubFetch()
+    await expect(useApi().post('/api/x', { membership_id: 1 }))
+      .rejects.toThrow(/membership_id.*body/)
+    expect(fetch).not.toHaveBeenCalled()
+  })
+
+  it('sends a body passed under body', async () => {
+    const fetch = stubFetch()
+    await useApi().post('/api/x', { body: { membership_id: 1 } })
+    expect(JSON.parse(fetch.mock.calls[0][1].body)).toEqual({ membership_id: 1 })
+  })
+
+  it('still accepts no options at all', async () => {
+    stubFetch()
+    await expect(useApi().get('/api/x')).resolves.toEqual({})
+  })
+})