Pilot: generated SDK, Query, Form

[ExtraToast]

What to build

auth-ui is the pilot: it proves the whole pipeline end-to-end on the smallest real surface before the pattern is applied anywhere else.

It is the right pilot because it is one store and 24 operations, and because it already imports the generated SDK — so the change is about configuration and state, not about rewriting a service layer. The honest objection is blast radius: breaking this app means nobody logs in. That is mitigated by keeping the diffs small and by the existing end-to-end gate.

The first ticket here is a deliberate tracer bullet — one operation cut through every layer — so the commons API is validated cheaply before it has three consumers.

Acceptance criteria

• The generated client is configured once, globally, rather than per call
• Server state lives in the Query cache, and the Pinia store that held it is gone
• Form validation derives from the contract, and the hand-written duplicate schemas are deleted
• Logging in still works, proven by the end-to-end suite

Blocked by

• Client publishing tracker (github-workflows)
• TanStack Query foundation (vue-web-commons)
• Declare the error contract (auth-api)