fix(HEL-99): 手机端 fetch 出口收敛到 shared/api.js + 架构清单刷新

Co-authored-by: multica-agent <github@multica.ai>

app/frontend/m/js/api.js

@@ -1,41 +1,24 @@
 (function (global) {
   "use strict";
 
+  // 手机端 API 薄封装：唯一 fetch 出口收敛到 shared/api.js（XiaobaiAPI）。
+  // 本文件不再直接调用 fetch，仅负责把 CSRF Token 配置进共享出口并转发请求，
+  // 保持既有 MobileAPI.request(url[, method, body]) 调用面不变。
+
   let csrfToken = "";
 
   function setCsrfToken(token) {
     csrfToken = token || "";
-  }
-
-  function requestOptions(method, body) {
-    const normalized = String(method || "GET").toUpperCase();
-    const options = { method: normalized, headers: {} };
-    if (!["GET", "HEAD", "OPTIONS"].includes(normalized) && csrfToken) {
-      options.headers["X-CSRF-Token"] = csrfToken;
-    }
-    if (body !== null && body !== undefined) {
-      options.headers["Content-Type"] = "application/json";
-      options.body = JSON.stringify(body);
-    }
-    return options;
+    global.XiaobaiAPI.configure({
+      csrfToken: function () {
+        return csrfToken;
+      }
+    });
   }
 
   async function request(url, method, body) {
-    const response = await fetch(url, requestOptions(method, body));
-    let payload = {};
-    try {
-      payload = await response.json();
-    } catch (_error) {
-      payload = {};
-    }
-    if (!response.ok || payload.error) {
-      const error = new Error(payload.error || "请求失败");
-      error.status = response.status;
-      error.payload = payload;
-      throw error;
-    }
-    return payload;
+    return global.XiaobaiAPI.request(url, method, body);
   }
 
-  global.MobileAPI = { setCsrfToken, request };
+  global.MobileAPI = { setCsrfToken: setCsrfToken, request: request };
 })(window);