Move every auth-ui operation onto the globally configured client

[ExtraToast]

What to build

Every operation in this application routes through the globally configured client rather than passing configuration per call.

This matters beyond tidiness: generated query options build their cache key from the options object, so passing base URL or headers per call would key the cache on request configuration including auth headers.

Acceptance criteria

• No call site passes base URL, credentials or headers
• Authentication and CSRF still work on every operation, proven end to end
• Cache keys derive from the operation, not from request configuration

Blocked by

• Tracer bullet: fetch the current user end-to-end through the new pipeline