feat(DRC-3149): migrate Recce OSS from Axios to native Fetch

[gcko]

Summary

• Replace all Axios usage in @datarecce/ui with a thin native fetch wrapper (fetchClient.ts), eliminating Axios as a supply-chain dependency after the npm compromise
• Migrate 32 source files and 3 test files from Axios to the new ApiClient interface
• Fix pre-existing localStorage.clear test failure in Node 22+ environments

What Changed

New: fetchClient.ts module (js/packages/ui/src/lib/fetchClient.ts)

A thin wrapper around native fetch that provides the same call patterns as the Axios subset we used:

Component	Purpose
ApiClient interface	get/post/patch/delete methods matching Axios signatures
ApiResponse<T>	Response shape with data, status, headers
HttpError<T>	Structured error with status, data, response getter (backward compat)
isHttpError()	Type guard replacing isAxiosError() with both instanceof and brand property for cross-module safety
createFetchClient()	Factory with baseURL, headers, timeout, middleware (replaces interceptors)

Features: auto JSON parse/serialize, FormData detection, query param serialization, AbortSignal.timeout, request middleware, network error wrapping (status: 0).

Core migration (3 files)

• ApiContext.tsx: axios.create() + interceptors.request.use() replaced with createFetchClient() + middleware. URL rewriting uses string ops (not new URL()) to handle both absolute and relative URLs.
• useApiConfig.ts: Default fallback client uses createFetchClient({ baseURL: PUBLIC_API_URL })
• RecceProvider.tsx: Props type changed from AxiosInstance to ApiClient

API module migration (22 files)

15 type-only files: AxiosInstance to ApiClient, AxiosResponse to ApiResponse
7 instance-creation files: axios.create() to createFetchClient()

Error handling migration (3 files)

• state.ts: isAxiosError to isHttpError, error.response?.status to error.status
• Filename.tsx: same pattern + error.response?.data?.detail to error.data?.detail
• LineageViewOss.tsx: AxiosError instanceof to HttpError instanceof

Test migration (3 files)

• ApiContext.test.tsx: Removed vi.mock("axios"), stub global fetch, added 7 middleware behavior tests
• Filename.test.tsx: AxiosError fixtures to HttpError fixtures
• LineageGraphAdapter.test.tsx: 22-line axios mock to single fetch stub

Cleanup

• Removed axios from package.json dependencies and pnpm.overrides
• Renamed AxiosQueryParams to QueryParams (deprecated alias kept)
• Renamed axiosClient.ts to queryClient.ts

Bonus fix: localStorage polyfill for Node 22+

Node 22+ ships a built-in localStorage that lacks standard Storage API methods. Added a polyfill in vitest.setup.mts, fixing 48 pre-existing test failures in Filename.test.tsx.

Code Review Findings Addressed

Finding	Severity	Fix
new URL(path, "") crashes when baseURL is empty	Critical	Use path directly when baseURL is falsy
isHttpError instanceof fragile across modules	Important	Added __isHttpError brand property
Network TypeError not wrapped in HttpError	Important	Wrap fetch errors in HttpError(0, null, message)
Malformed JSON results in SyntaxError	Important	Wrap parseResponseBody in try/catch
FormData does not remove default Content-Type	Important	Explicit headers.delete("Content-Type")
Middleware new URL() crashes on relative paths	Bug	Switched to string manipulation

Test plan

• pnpm type:check - 0 errors
• pnpm lint:fix - clean
• pnpm test - 3592 passed, 0 failed (146 files)
• pnpm run build - successful
• Zero axios imports in source code
• axios removed from package.json and lockfile
• fetchClient unit tests: 33 tests covering HTTP methods, params, headers, FormData, errors, parsing, middleware, timeout, empty baseURL, malformed JSON, network errors
• ApiContext integration tests: 29 tests covering provider behavior, middleware URL rewriting, auth injection, memoization

Incidental formatting (non-functional)

Pre-commit hooks auto-formatted two files outside the migration scope: recce/adapter/dbt_adapter/__init__.py (single→double quotes in getattr() calls) and tests/adapter/dbt_adapter/test_dbt_cll.py (line wrapping for long assertions). No logic changes — just style normalization triggered by the commit hooks.

Closes DRC-3149

🤖 Generated with Claude Code

[kentwelcome]

LGTM