fix: surface dashboard API error messages

[Topleess]

Summary

• surface backend-provided error messages in the dashboard instead of only showing an HTTP status
• fall back to API Error: <status> when an error response is not valid JSON
• extract the small API client so its success and failure behavior can be tested without loading the full dashboard

Motivation

While testing the self-hosted dashboard, failed actions such as platform login returned useful JSON error details from the backend, but the UI discarded them and displayed only messages such as API Error: 400. This made setup and recovery unnecessarily difficult.

Test plan

• node --test test/api-client.test.js
• npm run check (24 tests pass)
• dashboard smoke test confirms api-client.js is served and loaded before app.js

Notes

npm audit --omit=dev still reports the repository's existing low-severity body-parser advisory; this PR does not change dependencies.