- Move request() verbatim from client.js to utils.js (breaks circular dep) - Add fetchWithRetry() consolidating 3 blob-download 401-retry patterns - Lazy import of authStore preserved for Pinia bootstrap cycle safety - Bearer token from authStore memory only per CLAUDE.md security rule