m4: global API-error surface (no more silent failures)

The api client now catches network failures and non-JSON bodies robustly,
and routes unexpected errors (offline / 5xx) to a global toast — 4xx stay
with the caller so forms keep their inline messages. Toast actions are now
optional (undo toasts keep their button; error toasts are message-only), and
ToastHost moved from AppShell to the app root so toasts show everywhere,
including the login screen.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FRgehjoz7Yv8LkUfADxACm

frontend/src/components/ToastHost.vue

@@ -19,11 +19,12 @@ const ui = useUiStore();
     >
       <span>{{ ui.toast.message }}</span>
       <button
+        v-if="ui.toast.action"
         type="button"
         class="font-semibold text-brand hover:underline focus:outline-none focus-visible:ring-2 focus-visible:ring-brand"
         @click="ui.runToastAction()"
       >
-        {{ ui.toast.actionLabel }}
+        {{ ui.toast.action.label }}
       </button>
       <button
         type="button"