Route inline /api fetch calls through the client service layer (#2838)

[atomantic]

Summary

Routes inline fetch('/api/...') calls through the documented client/src/services/ layer, per the /do:better audit (issue #2838).

• New client/src/services/apiPrompts.js — wraps the Prompt Manager's 13+ raw /api/prompts* calls (stage templates, variables, job-skill templates). Registered in the api.js barrel and added as a row in services/README.md. The /api/providers list these surfaces need reuses the existing apiProviders.getProviders rather than re-wrapping the endpoint.
• client/src/pages/PromptManager.jsx — all inline fetches now call the apiPrompts helpers. Custom error toasts pass { silent: true } to avoid double-toasting.
• client/src/pages/ImageGen.jsx — flux2-status, hf-token-status, and the multipart image-gen/generate fetch route through new/extended apiImageVideo.js helpers (getFlux2Status, getHfTokenStatus({ signal }), generateImageMultipart).
• client/src/components/settings/LocalSetupPanel.jsx — setup/check, setup/python, setup/create-venv route through new apiImageVideo.js helpers (checkImageGenSetup, detectImageGenPython, createImageGenVenv). These use fetch() inside the service (not request()) so the panel's intentional AbortError handling is preserved — request() collapses abort into a generic error.
• client/src/components/writers-room/StagePromptModelPicker.jsx — routes through apiPrompts.getPrompt/savePrompt and apiProviders.getProviders.
• client/src/components/apps/tabs/GsdTab.jsx — routes through existing getAppDocuments/getGsdProject/getGsdPhases (the first two gained an options param so callers can pass { silent: true }).
• client/src/hooks/useTheme.js — the settings read/write route through apiSystem.getSettings/updateSettings with { silent: true } (the hook already degrades to the localStorage theme and warns on its own). The GET's abort guard also checks controller.signal.aborted, since request() collapses an aborted fetch into a generic error.

Behavior is preserved throughout (silent-vs-toast conventions, optimistic rollback, abort handling).

Sweep completeness

grep over client/src/{pages,components,hooks,lib,utils} now finds no inline /api/ fetch outside client/src/services/. VideoGen.jsx's site — carved out of this issue's scope — was already routed through a service wrapper by the VideoGen split (#2834), so nothing is left deferred. The few remaining raw fetch() calls live inside services/ by design, where the caller needs AbortError or streaming semantics that request() collapses.

Test plan

• cd client && npm test — 417 files / 4568 tests pass.
• ESLint clean on all changed files.
• codex review --base origin/main — no findings.

Closes #2838