test(admin): cover lib/api fetch wrapper (close Phase C coverage gap)

docs/reference/domain-test-checklist.md

@@ -598,3 +598,18 @@ Guaranteed behaviors:
 - Lifecycle (`src/screens/Stopwatch.test.tsx`): running locally after a successful start, when the
   active-sessions poll returns a list **without** the local session (only another worker's), the timer
   resets to idle and the `Deze sessie is door de beheerder gestopt.` notice shows.
+
+## Admin lib/api (fetch wrapper)
+
+Src covered: `apps/admin/src/lib/api.ts` — 100% stmts/branch/funcs/lines. (Filled in Phase C —
+this base fetch helper fell between the D-domains, which covered the per-resource `api/*.ts`.)
+
+Guaranteed behaviors:
+
+- `apiFetch` attaches `Authorization: Bearer <token>` when a token is stored, and omits it when not.
+- It sets `Content-Type: application/json` when a body is present and none was set, and never
+  overrides an explicitly provided `Content-Type`.
+- It throws `ApiError` (carrying the HTTP status) on any non-2xx response, and returns `undefined`
+  for an empty 2xx body (otherwise the parsed JSON).
+- `signIn` posts to `/api/auth/sign-in/email`, stores the token from the `set-auth-token` header,
+  throws `ApiError` on rejected credentials, and throws `ApiError(500)` when the header is missing.