Initial eth_hedge_sim: P0 market, auth UI, one-click deploy.

Co-authored-by: Cursor <cursoragent@cursor.com>

frontend/src/api/client.ts

@@ -0,0 +1,110 @@
+const API_KEY = "eth_hedge_api_base";
+const TOKEN_KEY = "eth_hedge_token";
+const USER_KEY = "eth_hedge_user";
+
+export function getApiBase(): string {
+  const saved = localStorage.getItem(API_KEY);
+  if (saved && saved.trim()) return saved.trim().replace(/\/$/, "");
+  // same-origin default when UI is served by backend on :5155
+  return window.location.origin;
+}
+
+export function setApiBase(url: string) {
+  localStorage.setItem(API_KEY, url.trim().replace(/\/$/, ""));
+}
+
+export function getToken(): string | null {
+  return localStorage.getItem(TOKEN_KEY);
+}
+
+export function setSession(token: string, username: string) {
+  localStorage.setItem(TOKEN_KEY, token);
+  localStorage.setItem(USER_KEY, username);
+}
+
+export function clearSession() {
+  localStorage.removeItem(TOKEN_KEY);
+  localStorage.removeItem(USER_KEY);
+}
+
+export function getUsername(): string | null {
+  return localStorage.getItem(USER_KEY);
+}
+
+export async function apiFetch<T>(
+  path: string,
+  options: RequestInit = {},
+): Promise<T> {
+  const base = getApiBase();
+  const headers = new Headers(options.headers || {});
+  if (!headers.has("Content-Type") && options.body) {
+    headers.set("Content-Type", "application/json");
+  }
+  const token = getToken();
+  if (token) headers.set("Authorization", `Bearer ${token}`);
+
+  const res = await fetch(`${base}${path}`, { ...options, headers });
+  if (res.status === 401) {
+    clearSession();
+    throw new Error("unauthorized");
+  }
+  const text = await res.text();
+  let data: unknown = null;
+  try {
+    data = text ? JSON.parse(text) : null;
+  } catch {
+    data = { detail: text };
+  }
+  if (!res.ok) {
+    const detail =
+      typeof data === "object" && data && "detail" in data
+        ? String((data as { detail: unknown }).detail)
+        : res.statusText;
+    throw new Error(detail || `HTTP ${res.status}`);
+  }
+  return data as T;
+}
+
+export type LoginResult = {
+  token: string;
+  username: string;
+  expires_in: number;
+  env_name: string;
+  mode: string;
+};
+
+export async function login(username: string, password: string) {
+  return apiFetch<LoginResult>("/api/auth/login", {
+    method: "POST",
+    body: JSON.stringify({ username, password }),
+  });
+}
+
+export type MarketSnapshot = {
+  connected: boolean;
+  updated_at_ms: number | null;
+  index_px: number | null;
+  pair: {
+    expiry_ymd: string;
+    strike: number;
+    call_inst_id: string;
+    put_inst_id: string;
+  } | null;
+  perp: Quote | null;
+  call: Quote | null;
+  put: Quote | null;
+  ask_compare: {
+    call_ask: number | null;
+    put_ask: number | null;
+    bias: string;
+  };
+};
+
+type Quote = {
+  inst_id: string;
+  bid: number | null;
+  ask: number | null;
+  bid_sz: number | null;
+  ask_sz: number | null;
+  mark_px: number | null;
+};