feat(web): unified reader with reading settings, faster lists, a11y

- New Reader (desktop + mobile): loads full content on open, prefetches
  the next article, reading progress and time, "Aa" settings (light /
  sepia / dark / auto theme, serif / sans / Atkinson Hyperlegible font,
  size, line height, measure), Space-to-next, keyboard shortcuts, focus
  management, inert background, URL-driven (?a=) so Back closes it.
- Dashboard: cursor pagination, unread/all filter, CSS grid (no masonry),
  no re-sorting under the reader, optimistic cache patches instead of
  refetch storms, "new articles" banner, error/offline states, j/k/o/m/s/v
  shortcuts and help dialog.
- Cards: keyboard-openable, lazy <img>, memoized, touch-only swipe.
- Focus mode: framer drag (drop @use-gesture), Read button, undo restores
  unread state, arrow keys.
- WebSocket: single connection, backoff, cache patching, no console logs.
- Contrast fixes (on-nature tokens), 44px targets, lang="fr", reduced
  motion, self-hosted fonts, theme applied before first paint.
- Code splitting + vendor chunk, prompt-based PWA updates, smaller
  precache, offline cache for opened articles and images, caches cleared
  on logout; upgrade react-router (CVE), drop unused deps and assets.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

web/src/api/client.ts

@@ -9,10 +9,27 @@ export class ApiError extends Error {
     }
 }
 
+type UnauthorizedListener = () => void;
+let onUnauthorized: UnauthorizedListener | null = null;
+
+/** Registers the handler run when an authenticated call gets a 401 (session expired). */
+export function setUnauthorizedHandler(fn: UnauthorizedListener) {
+    onUnauthorized = fn;
+}
+
 export async function handleResponse<T>(response: Response): Promise<T> {
     if (!response.ok) {
         const error = await response.json().catch(() => ({ error: 'Request failed' }));
+        if (response.status === 401 && !response.url.includes('/auth/')) {
+            onUnauthorized?.();
+        }
         throw new ApiError(response.status, error.error || 'Request failed');
     }
     return response.json();
 }
+
+/** fetch() with cookies and JSON handling. */
+export async function apiFetch<T>(path: string, init: RequestInit = {}): Promise<T> {
+    const response = await fetch(`${API_BASE}${path}`, { credentials: 'include', ...init });
+    return handleResponse<T>(response);
+}