M9 S2: fold raw multipart fetches into api.postForm

Both notes-store uploads (uploadAttachment, importNotes) hand-rolled the
same fetch + resp.json() + !ok error parsing that api.client already does.
Add `api.postForm<T>(path, form)`: request() now detects a FormData body
and lets the browser set the multipart Content-Type (skipping the JSON
header + stringify), reusing the shared error handling — so the two
uploads gain network-error handling and the 5xx infra toast they lacked.
A too-large import returns 413 (< 500), so it still throws for inline
display rather than toasting.

DRY: net -13 lines; no raw fetch() remains in the stores.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FRgehjoz7Yv8LkUfADxACm

frontend/src/api/client.ts

@@ -16,13 +16,16 @@ function notifyError(err: ApiError) {
 }
 
 async function request<T>(method: string, path: string, body?: unknown): Promise<T> {
+  // FormData carries its own multipart Content-Type (with boundary), so let the
+  // browser set it — only JSON bodies get an explicit header + stringify.
+  const isForm = body instanceof FormData;
   let resp: Response;
   try {
     resp = await fetch(path, {
       method,
       credentials: "include", // send/receive the signed session cookie
-      headers: body !== undefined ? { "Content-Type": "application/json" } : undefined,
-      body: body !== undefined ? JSON.stringify(body) : undefined,
+      headers: body !== undefined && !isForm ? { "Content-Type": "application/json" } : undefined,
+      body: body === undefined ? undefined : isForm ? body : JSON.stringify(body),
     });
   } catch {
     const err: ApiError = { error: "Can't reach the server. Check your connection.", status: 0 };
@@ -59,4 +62,5 @@ export const api = {
   patch: <T>(path: string, body?: unknown) => request<T>("PATCH", path, body),
   put: <T>(path: string, body?: unknown) => request<T>("PUT", path, body),
   del: <T>(path: string) => request<T>("DELETE", path),
+  postForm: <T>(path: string, form: FormData) => request<T>("POST", path, form),
 };

frontend/src/stores/notes.ts

@@ -205,16 +205,7 @@ export const useNotesStore = defineStore("notes", () => {
   async function uploadAttachment(id: string, file: File): Promise<void> {
     const form = new FormData();
     form.append("file", file);
-    const resp = await fetch(`/api/notes/${id}/attachments`, { method: "POST", credentials: "include", body: form });
-    const data: unknown = await resp.json().catch(() => ({}));
-    if (!resp.ok) {
-      const message =
-        typeof data === "object" && data !== null && "error" in data
-          ? String((data as { error: unknown }).error)
-          : "Upload failed.";
-      throw { error: message, status: resp.status };
-    }
-    reconcile(data as Note);
+    reconcile(await api.postForm<Note>(`/api/notes/${id}/attachments`, form));
   }
 
   async function deleteAttachment(id: string, attId: string): Promise<void> {
@@ -232,18 +223,10 @@ export const useNotesStore = defineStore("notes", () => {
   async function importNotes(file: File): Promise<{ source: string; imported: number; skipped: number }> {
     const form = new FormData();
     form.append("file", file);
-    const resp = await fetch("/api/notes/import", { method: "POST", credentials: "include", body: form });
-    const data: unknown = await resp.json().catch(() => ({}));
-    if (!resp.ok) {
-      const message =
-        typeof data === "object" && data !== null && "error" in data
-          ? String((data as { error: unknown }).error)
-          : "Import failed.";
-      throw { error: message, status: resp.status };
-    }
+    const data = await api.postForm<{ source: string; imported: number; skipped: number }>("/api/notes/import", form);
     // Refresh the current lens so imported notes appear (labels reloaded by caller).
     await load(view.value, activeLabel.value, activeFacets.value);
-    return data as { source: string; imported: number; skipped: number };
+    return data;
   }
 
   async function fetchOne(id: string): Promise<Note | null> {