refactor(maestro): route every client through the shared DaemonClient

The CLI, TUI and end-to-end harness each carried their own client: three
reqwest builders with three timeout policies, three copies of the
success-or-body check, and route strings at every call site. Two of them
discarded the daemon's structured error and reported only a status code.

Deletes `maestro-cli/src/http.rs`, both `ws_base` copies in the TUI, the
CLI's partial `DaemonInfo` (it dropped `version` and `presets`), and the
e2e harness's `check_ok`. `maestro-web` gains a protocol dependency and
stops building the error envelope with a format string and reading it back
as untyped JSON; the daemon and the proxy now register routes from the same
constants.

`maestro_web::router` returns `Result` — an unusable daemon URL fails at
startup instead of at first connect.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

web/src/api.ts

@@ -1,3 +1,4 @@
+import * as routes from "./routes.js";
 import type {
   ApiError,
   CreateSessionRequest,
@@ -25,12 +26,12 @@ async function jsonOrError<T>(res: Response): Promise<T> {
 }
 
 export async function listSessions(): Promise<Session[]> {
-  return jsonOrError(await fetch("/api/sessions", { credentials: "same-origin" }));
+  return jsonOrError(await fetch(routes.SESSIONS, { credentials: "same-origin" }));
 }
 
 export async function createSession(req: CreateSessionRequest): Promise<Session> {
   return jsonOrError(
-    await fetch("/api/sessions", {
+    await fetch(routes.SESSIONS, {
       method: "POST",
       credentials: "same-origin",
       headers: { "content-type": "application/json" },
@@ -41,7 +42,7 @@ export async function createSession(req: CreateSessionRequest): Promise<Session>
 
 export async function killSession(id: Uuid): Promise<void> {
   await jsonOrError(
-    await fetch(`/api/sessions/${encodeURIComponent(id)}`, {
+    await fetch(routes.session(id), {
       method: "DELETE",
       credentials: "same-origin",
     }),
@@ -51,30 +52,27 @@ export async function killSession(id: Uuid): Promise<void> {
 /** List one directory's immediate subdirectories (NAP-329). `path` may be empty,
  * `~`, relative, or absolute — the daemon resolves it against its home dir. */
 export async function listDir(path: string): Promise<DirListing> {
-  const url = `/api/dirs?path=${encodeURIComponent(path)}`;
+  const url = routes.withPathQuery(routes.DIRS, path);
   return jsonOrError(await fetch(url, { credentials: "same-origin" }));
 }
 
 /** Identity + spawn presets of the daemon this web app is connected to (#26). */
 export async function getDaemonInfo(): Promise<DaemonInfo> {
-  return jsonOrError(await fetch("/api/info", { credentials: "same-origin" }));
+  return jsonOrError(await fetch(routes.INFO, { credentials: "same-origin" }));
 }
 
 /** Recently-used working dirs, newest-first and deduped by dir (#26). Drives the
  * spawn form's recents picker. */
 export async function recentDirs(): Promise<RecentDirs> {
-  return jsonOrError(await fetch("/api/recent-dirs", { credentials: "same-origin" }));
+  return jsonOrError(await fetch(routes.RECENT_DIRS, { credentials: "same-origin" }));
 }
 
 /** Probe the enclosing git repo of `path` (#26). `root` is absent when the path
  * isn't inside a repo. `path` may be `~`/relative/absolute; the daemon resolves
  * it against its home dir. */
 export async function gitRoot(path: string): Promise<GitRoot> {
-  const url = `/api/gitroot?path=${encodeURIComponent(path)}`;
+  const url = routes.withPathQuery(routes.GITROOT, path);
   return jsonOrError(await fetch(url, { credentials: "same-origin" }));
 }
 
-export function eventsWsUrl(): string {
-  const proto = location.protocol === "https:" ? "wss:" : "ws:";
-  return `${proto}//${location.host}/api/events`;
-}
+export { eventsWsUrl } from "./routes.js";