Add backend health check, fetch timeouts, stale token cleanup, and error screen

Frontend now checks /health before starting auth flow. Shows a clear
"Cannot Connect to Server" screen with retry button when backend is
unreachable. Stale non-JWT tokens in localStorage are detected and
cleared automatically. All API calls have a 10s timeout via AbortController.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

apps/web/src/lib/api.ts

@@ -63,30 +63,53 @@ export function needsPasswordReset(): boolean {
   return payload?.mustResetPassword === true;
 }
 
-async function request<T>(path: string, options: RequestInit = {}): Promise<T> {
+async function request<T>(path: string, options: RequestInit & { timeoutMs?: number } = {}): Promise<T> {
+  const { timeoutMs = 10_000, ...fetchOptions } = options;
+
   const headers: Record<string, string> = {
     'Content-Type': 'application/json',
-    ...(options.headers as Record<string, string>),
+    ...(fetchOptions.headers as Record<string, string>),
   };
 
   if (authToken) {
     headers['Authorization'] = `Bearer ${authToken}`;
   }
 
-  const res = await fetch(`${API_BASE}${path}`, {
-    ...options,
-    headers,
-  });
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), timeoutMs);
 
-  if (!res.ok) {
-    const body = await res.json().catch(() => ({ error: 'Unknown error' }));
-    throw new Error(body.error || `HTTP ${res.status}`);
+  try {
+    const res = await fetch(`${API_BASE}${path}`, {
+      ...fetchOptions,
+      headers,
+      signal: controller.signal,
+    });
+
+    if (!res.ok) {
+      const body = await res.json().catch(() => ({ error: 'Unknown error' }));
+      throw new Error(body.error || `HTTP ${res.status}`);
+    }
+
+    return res.json();
+  } catch (e) {
+    if (e instanceof DOMException && e.name === 'AbortError') {
+      throw new Error('Request timed out — server may be unreachable');
+    }
+    throw e;
+  } finally {
+    clearTimeout(timeout);
   }
+}
 
-  return res.json();
+export function validateStoredToken(): void {
+  const token = getAuthToken();
+  if (token && !decodeTokenPayload(token)) {
+    clearAuthToken();
+  }
 }
 
 export const api = {
+  health: () => request<{ status: string }>('/health', { timeoutMs: 5_000 }),
   auth: {
     anonymous: () => request<{ userId: string; token: string }>('/api/auth/anonymous', { method: 'POST' }),
     login: (login: string, password: string) =>