test(worker): lib/api + app/nav — fill gaps + lifecycle test

docs/reference/domain-test-checklist.md

@@ -327,3 +327,31 @@ Guaranteed behaviors:
 - Lifecycle (`src/screens/Account.test.tsx`): from the authenticated app on the Account screen,
   clicking `Uitloggen` flips the auth context to unauthenticated so the login form
   (`E-mailadres`) renders and the `Uitloggen` button is gone (token cleared).
+
+## lib/api + app/nav — worker client
+
+Src covered (worker `apps/worker`): `src/lib/api.ts`, `src/App.tsx`, `src/components/TabBar.tsx`,
+`src/api/sessions.ts`, `src/api/activities.ts`, `src/api/me.ts` — all 100% stmts/branch/funcs/lines.
+No `c8 ignore`s needed.
+
+Guaranteed behaviors:
+
+- `apiFetch` attaches `Authorization: Bearer <token>` when a token is stored and omits it otherwise.
+- `apiFetch` sets `Content-Type: application/json` when a request has a body and no explicit
+  Content-Type, and does not override a Content-Type the caller supplied.
+- `apiFetch` parses a JSON response body, and returns `undefined` when the body is empty.
+- `apiFetch` throws `ApiError` (carrying the HTTP status) on any non-2xx response.
+- `signIn` POSTs to `/api/auth/sign-in/email`, stores the token from the `set-auth-token` header,
+  and throws `ApiError` when the response is not ok or the header is missing.
+- `App` gates on auth state: no token renders `Login` (no tab bar); a token renders the authed shell
+  with the Stopwatch screen mounted at `/` beside the `TabBar`.
+- `TabBar` renders the three tabs (`Stopwatch` → `/`, `Geschiedenis` → `/history`,
+  `Account` → `/account`) as links, marks the current route's tab `tab-active`, and uses `end`
+  matching so the Stopwatch tab is active only on the root path.
+- Each `api/*` hook hits the right path/method: `useSessions` → GET `/api/sessions`;
+  `useActiveSessions` → GET `/api/sessions/active`; `useStartSession` → POST `/api/sessions/start`
+  with the serialized input; `useStop/Discard/Pause/ResumeSession` → POST `/api/sessions/:id/<action>`;
+  `useActivities` → GET `/api/activities`; `useMe` → GET `/api/me`. Every mutation invalidates the
+  `['sessions']` query cache on success.
+- Lifecycle (`src/App.test.tsx`): unauthenticated renders `Login` with no navigation; authenticated
+  renders the Stopwatch screen under the tab bar and no login form.