fix(api): harden response contracts

apps/web_v1/scripts/structure-check.mjs

@@ -23,6 +23,7 @@ const requiredFiles = [
   'src/api/mappers.tsx',
   'src/api/search.ts',
   'src/api/inbox.ts',
+  'scripts/api-client.test.mjs',
 ]
 
 const failures = requiredFiles.filter((file) => !existsSync(file)).map((file) => `missing ${file}`)
@@ -77,9 +78,17 @@ for (const match of apiSource.matchAll(/export type (\w+DTO)\s*=\s*\{([\s\S]*?)\
   if (/^\s*[A-Z]\w*\s*:/m.test(body)) failures.push(`${name} fields must use camelCase`)
   if (/^\s*(?:id|\w+Id)\s*:\s*number\b/im.test(body)) failures.push(`${name} identities must be strings`)
 }
+if (/\|\s*undefined/.test(projectsSource)) failures.push('project DTOs must not use undefined fields')
 
 const searchSource = readFileSync('src/api/search.ts', 'utf8')
 if (!searchSource.includes("'/api/v1/search'")) failures.push('search API must use /api/v1/search')
+for (const unsupportedType of ["'source'", "'inbox'", "'ai_session'"]) {
+  if (searchSource.includes(unsupportedType)) failures.push(`search DTO contains unsupported result type ${unsupportedType}`)
+}
+
+const loginSource = readFileSync('src/pages/login.tsx', 'utf8')
+if (!loginSource.includes("import { normalizeBaseUrl } from '../api/client'")) failures.push('login must share the API base URL normalizer')
+if (loginSource.includes('function normalizeBaseUrl')) failures.push('login must not define a second base URL normalizer')
 
 const inboxSource = readFileSync('src/api/inbox.ts', 'utf8')
 for (const path of ['/api/v1/projects/', '/api/v1/inbox/']) {