refactor(frontend): migrate monitoring/health composables off raw fetch (#12363 Phase 2 batch 3)

[mrveiss]

Thinking Path

#12363 Phase 2 migrates the main autobot-frontend off raw fetch(. This batch (3) covers the monitoring/health composables — the HTTP ones only. I grepped each candidate, split them by which backend they target and whether the URL is app-owned vs arbitrary, and migrated only the app-backend probes. For probes I used the fetchWithAuth bridge rather than ApiClient.rawRequest, because these sites deliberately keep the raw Response and swallow errors into a graceful null — routing them through ApiClient would add its 401 → logout/redirect side effect that plain fetch never had.

What Changed

Per file:

• composables/useHealthProbeRegistry.ts — MIGRATED. fetch(${getApiBase()}/system/health/probes) → fetchWithAuth(...). App backend, GET. Now attaches the JWT; .ok/.json()/non-array checks and the "never poison the cache" graceful-null semantics are byte-for-byte preserved.
• composables/useNetworkStatus.ts — MIGRATED. fetch(${getApiBase()}/health, { method: 'HEAD', cache: 'no-store', signal }) → fetchWithAuth(url, {...}). App backend reachability probe; HEAD / cache: 'no-store' / AbortSignal.timeout and the res.ok || res.status < 500 "any non-5xx = online" logic are unchanged. fetchWithAuth returns a raw Response, so the probe keeps its exact shape and never triggers a logout on 401.
• composables/__tests__/useHealthProbeRegistry.test.ts — ADDED. Asserts the registry now routes through fetchWithAuth against /api/system/health/probes, caches, refetches on refresh, and returns null (no cache poisoning) on non-ok / non-string-array / thrown-error.

Deliberately skipped (grepped + judged; out of scope for the app-backend bridge):

• composables/useConnectionTester.ts — fetch(endpoint.value, ...) where endpoint.value is an arbitrary/config-supplied URL (documented examples: backend health, Redis ping, LLM tags, external hosts). Forcing it through the app client would prepend the app base URL and inject the app JWT/org headers onto third-party hosts. Left as raw fetch by design.
• composables/useHostInventory.ts — targets the SLM control-plane backend (getSLMUrl()), a distinct backend from the app; currently sends no app JWT. The app-scoped fetchWithAuth would inject the wrong (app) token. Needs a dedicated SLM client — see Follow-up.
• composables/useTLSCredentials.ts — also SLM, with its own token lifecycle (authenticate() / setAuthToken() → Bearer authToken.value). Routing through the app bridge would inject the wrong JWT. See Follow-up.

No WebSocket/EventSource builders were present in these files (usePrometheusMetrics and other WS sites are out of scope per the phase plan).

Verification

• vue-tsc --noEmit -p tsconfig.app.json → exit 0 (clean).
• vitest run on useHealthProbeRegistry.test.ts, useNetworkStatus.test.ts, useProbeBackedHealth.test.ts → 24 passed (3 files).
• Grep of migrated files → no remaining backend raw fetch(; both now import and use fetchWithAuth.
• Temporary read-only node_modules symlink (from main tree) used for vue-tsc/vitest, then removed — not committed.

Model Used

claude-opus-4-8

Follow-up

Remaining #12363 raw-fetch inventory (later batches):

• Components: DesktopInterface, VideoProcessor, plus the infra component set.
• SLM control-plane composables useHostInventory + useTLSCredentials — need a dedicated SLM auth bridge (analogous to slmApiClient in autobot-slm-frontend); MUST NOT be forced through the app fetchWithAuth/ApiClient.
• Do NOT migrate: WebSocket/EventSource services and ssot-config URL builders.

Refs #12363
Closes #12612

[github-actions]

✅ SSOT Configuration Compliance: Passing

🎉 No hardcoded values detected that have SSOT config equivalents!