m4: global API-error surface (no more silent failures)

The api client now catches network failures and non-JSON bodies robustly,
and routes unexpected errors (offline / 5xx) to a global toast — 4xx stay
with the caller so forms keep their inline messages. Toast actions are now
optional (undo toasts keep their button; error toasts are message-only), and
ToastHost moved from AppShell to the app root so toasts show everywhere,
including the login screen.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FRgehjoz7Yv8LkUfADxACm

frontend/src/components/AppShell.vue

@@ -8,7 +8,6 @@ import { useUiStore } from "../stores/ui";
 import CommandPalette from "./CommandPalette.vue";
 import Icon from "./Icon.vue";
 import LabelsModal from "./LabelsModal.vue";
-import ToastHost from "./ToastHost.vue";
 import { NOTE_SWATCH_CLASSES, type NoteColor } from "../notes/colors";
 
 const route = useRoute();
@@ -297,8 +296,6 @@ async function signOut() {
 
     <CommandPalette v-if="paletteOpen" @close="paletteOpen = false" />
 
-    <ToastHost />
-
     <div
       v-if="showShortcuts"
       class="fixed inset-0 z-50 flex items-center justify-center bg-black/40 p-4"

frontend/src/components/ToastHost.vue

@@ -19,11 +19,12 @@ const ui = useUiStore();
     >
       <span>{{ ui.toast.message }}</span>
       <button
+        v-if="ui.toast.action"
         type="button"
         class="font-semibold text-brand hover:underline focus:outline-none focus-visible:ring-2 focus-visible:ring-brand"
         @click="ui.runToastAction()"
       >
-        {{ ui.toast.actionLabel }}
+        {{ ui.toast.action.label }}
       </button>
       <button
         type="button"