refactor(frontend): route last 2 clients through canonical ApiClient — AdvancedControl + Secrets (#12363 Phase 1)

[mrveiss]

Thinking Path

#12363 (single-transport guarantee) was already ~75% delivered by #12152, which routed 6 of 8 frontend HTTP clients through the canonical utils/ApiClient.ts. This PR finishes the transport half by migrating the last 2 outliers so every client shares one transport (centralised base-URL resolution, auth-token injection, org-context headers). Kept strictly behaviour-neutral.

What Changed

• autobot-frontend/src/utils/AdvancedControlApiClient.ts (imports ~L12–15, request<T> ~L191–222, POST bodies): replaced fetchWithAuth with apiClient.rawRequest, mirroring the existing thin-typed-wrapper pattern in VisionMultimodalApiClient.ts / FeatureFlagsApiClient.ts (the "thin typed wrapper refactor(frontend): fold VisionMultimodal + FeatureFlags clients into shared apiClient (#11682 Tier-2) #12152" comment). Dropped the local getBaseUrl() (base-URL now resolved by the singleton) and stopped hand-stringifying request bodies (rawRequest JSON-serialises objects). getConfig retained for the WS-URL helpers.
  • Behaviour-neutral choice: rawRequest (single-shot) is used deliberately instead of apiClient.get() — get() would add retry + 401-auto-logout, a behaviour change reserved as a separate owner decision (see Follow-up).
• autobot-frontend/src/utils/SecretsApiClient.{js,d.ts} → SecretsApiClient.ts: folded the hand-written .d.ts types into a single typed .ts (already correctly wrapping apiClient). Identical runtime behaviour and identical import surface — the named secretsApiClient export, the default class export, and all public types are preserved, so no caller changes were needed. This is a 1:1 format conversion, not a code deletion.

Callers confirmed unchanged via grep: useAdvancedControl.ts / AdvancedControlView.vue for the former; SecretVault.vue, SecretsManager.vue, HostSelectionDialog.vue, ProjectBrowserView.vue for the latter (all import only the named secretsApiClient).

The other 6 already-consolidated clients, raw-fetch files, and generated types were intentionally untouched.

Verification

• vue-tsc --noEmit -p tsconfig.app.json → clean (exit 0).
• vitest run on useAdvancedControl.test.ts + HostSelectionDialog.test.ts → 22 passed (exit 0).
• grep confirms no remaining fetchWithAuth in AdvancedControl (only a comment), and no explicit .js/.d.ts import references to the converted Secrets module.

Model Used

Claude Opus 4.8

Follow-up

Remaining phases of #12363 are out of scope here:

• Phase 2 — raw-fetch retirement (remaining direct fetch/fetchWithAuth call-sites).
• Phase 3 — generated-type adoption.
• Owner decision — whether AdvancedControl/Secrets should inherit apiClient's retry + 401-auto-logout semantics (switching from rawRequest/single-shot to get/post/...). That is a deliberate behaviour change and is left to the owner.

Refs #12363
Closes #12582

[github-actions]

✅ SSOT Configuration Compliance: Passing

🎉 No hardcoded values detected that have SSOT config equivalents!

[codecov]

Codecov Report

❌ Patch coverage is 5.88235% with 144 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
autobot-frontend/src/utils/SecretsApiClient.ts	5.88%	144 Missing ⚠️

📢 Thoughts on this report? Let us know!