fix: full-stack E2E hardening — client blobs, modal errors, audit coverage, MCP context

- api-client: getResponseBody returns Blob for non-JSON (fixes storage
  preview/download TypeError); postgen.mjs reapplies the patch on regen
- Modal: error prop renders inside the dialog so request failures are
  visible instead of hidden behind the overlay (6 pages wired)
- lib/api: extract server-provided error message from error.body
- Modal: unique id per instance (duplicate modal-title broke aria-label)
- nginx: index.html no-cache + immutable /assets (stale shell pointed at
  deleted hashed assets after redeploy → white screen)
- vite: drop dead Google Fonts runtime caching (fonts are vendored)
- functions: audit function.created/updated/deleted/invoked
- AuditPage: expand action filter to all recorded actions
- MCP: whoami uses /context for API keys; projectId/orgId resolve via
  /context with auth-aware precedence (stale `primora use` selection can
  never authorize a differently-scoped key)

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

packages/api-client/package.json

@@ -6,7 +6,7 @@
   "main": "./src/index.ts",
   "types": "./src/index.ts",
   "scripts": {
-    "generate": "openapi --input ../../apps/backend/openapi/openapi.yaml --output ./src/generated --client fetch --useOptions --exportSchemas true"
+    "generate": "openapi --input ../../apps/backend/openapi/openapi.yaml --output ./src/generated --client fetch --useOptions --exportSchemas true && node ./postgen.mjs"
   },
   "dependencies": {
     "cross-fetch": "^4.1.0"

packages/api-client/postgen.mjs

@@ -0,0 +1,19 @@
+// Post-generation patch: openapi-typescript-codegen's request.ts returns
+// response.text() for every non-JSON response, but binary endpoints (object
+// download) are typed Blob. Return a real Blob so the generated contract holds.
+import { readFile, writeFile } from "node:fs/promises";
+
+const file = new URL("./src/generated/core/request.ts", import.meta.url);
+const source = await readFile(file, "utf8");
+const needle = "return await response.text();";
+const replacement = "return await response.blob();";
+
+if (source.includes(replacement)) {
+  process.exit(0);
+}
+if (!source.includes(needle)) {
+  console.error("postgen: response.text() call not found in request.ts — patch manually");
+  process.exit(1);
+}
+await writeFile(file, source.replace(needle, replacement));
+console.log("postgen: patched getResponseBody to return Blob for non-JSON responses");

packages/api-client/src/generated/core/request.ts

@@ -239,7 +239,7 @@ export const getResponseBody = async (response: Response): Promise<any> => {
                 if (isJSON) {
                     return await response.json();
                 } else {
-                    return await response.text();
+                    return await response.blob();
                 }
             }
         } catch (error) {