refactor: extract auth-routing from workspaceApi to auth domain

- Add getAuthHeaderOrThrow() and getFirebaseAuthHeaderOrThrow() to authStore
- Delegate workspaceApi's auth-or-throw helpers to authStore methods
- Remove unused i18n import from workspaceApi
- Update shared mock factory with new methods
- Thrown errors now use AuthStoreError (auth domain)

src/platform/workspace/api/workspaceApi.ts

@@ -1,6 +1,5 @@
 import axios from 'axios'
 
-import { t } from '@/i18n'
 import { api } from '@/scripts/api'
 import { useAuthStore } from '@/stores/authStore'
 
@@ -288,27 +287,11 @@ const workspaceApiClient = axios.create({
 })
 
 async function getAuthHeaderOrThrow() {
-  const authHeader = await useAuthStore().getAuthHeader()
-  if (!authHeader) {
-    throw new WorkspaceApiError(
-      t('toastMessages.userNotAuthenticated'),
-      401,
-      'NOT_AUTHENTICATED'
-    )
-  }
-  return authHeader
+  return useAuthStore().getAuthHeaderOrThrow()
 }
 
 async function getFirebaseHeaderOrThrow() {
-  const authHeader = await useAuthStore().getFirebaseAuthHeader()
-  if (!authHeader) {
-    throw new WorkspaceApiError(
-      t('toastMessages.userNotAuthenticated'),
-      401,
-      'NOT_AUTHENTICATED'
-    )
-  }
-  return authHeader
+  return useAuthStore().getFirebaseAuthHeaderOrThrow()
 }
 
 function handleAxiosError(err: unknown): never {

src/stores/__tests__/authStoreMock.ts

@@ -28,7 +28,9 @@ export interface AuthStoreMockControls {
   logout: Mock
   getIdToken: Mock
   getAuthHeader: Mock
+  getAuthHeaderOrThrow: Mock
   getFirebaseAuthHeader: Mock
+  getFirebaseAuthHeaderOrThrow: Mock
   getAuthToken: Mock
   createCustomer: Mock
   fetchBalance: Mock
@@ -63,7 +65,13 @@ export function createAuthStoreMock(): {
     logout: vi.fn(),
     getIdToken: vi.fn().mockResolvedValue('mock-id-token'),
     getAuthHeader: vi.fn().mockResolvedValue(null),
+    getAuthHeaderOrThrow: vi.fn().mockResolvedValue({
+      Authorization: 'Bearer mock-id-token'
+    }),
     getFirebaseAuthHeader: vi.fn().mockResolvedValue(null),
+    getFirebaseAuthHeaderOrThrow: vi.fn().mockResolvedValue({
+      Authorization: 'Bearer mock-id-token'
+    }),
     getAuthToken: vi.fn().mockResolvedValue(undefined),
     createCustomer: vi.fn(),
     fetchBalance: vi.fn(),

src/stores/authStore.test.ts

@@ -730,6 +730,37 @@ describe('useAuthStore', () => {
     })
   })
 
+  describe('getAuthHeaderOrThrow', () => {
+    it('returns auth header when authenticated', async () => {
+      const header = await store.getAuthHeaderOrThrow()
+      expect(header).toEqual({ Authorization: 'Bearer mock-id-token' })
+    })
+
+    it('throws AuthStoreError when not authenticated', async () => {
+      authStateCallback(null)
+      mockApiKeyGetAuthHeader.mockReturnValue(null)
+
+      await expect(store.getAuthHeaderOrThrow()).rejects.toThrow(
+        'toastMessages.userNotAuthenticated'
+      )
+    })
+  })
+
+  describe('getFirebaseAuthHeaderOrThrow', () => {
+    it('returns Firebase auth header when authenticated', async () => {
+      const header = await store.getFirebaseAuthHeaderOrThrow()
+      expect(header).toEqual({ Authorization: 'Bearer mock-id-token' })
+    })
+
+    it('throws AuthStoreError when not authenticated', async () => {
+      authStateCallback(null)
+
+      await expect(store.getFirebaseAuthHeaderOrThrow()).rejects.toThrow(
+        'toastMessages.userNotAuthenticated'
+      )
+    })
+  })
+
   describe('createCustomer', () => {
     it('should succeed with API key auth when no Firebase user is present', async () => {
       authStateCallback(null)

src/stores/authStore.ts

@@ -236,6 +236,22 @@ export const useAuthStore = defineStore('auth', () => {
     return await getIdToken()
   }
 
+  const getAuthHeaderOrThrow = async (): Promise<AuthHeader> => {
+    const authHeader = await getAuthHeader()
+    if (!authHeader) {
+      throw new AuthStoreError(t('toastMessages.userNotAuthenticated'))
+    }
+    return authHeader
+  }
+
+  const getFirebaseAuthHeaderOrThrow = async (): Promise<AuthHeader> => {
+    const authHeader = await getFirebaseAuthHeader()
+    if (!authHeader) {
+      throw new AuthStoreError(t('toastMessages.userNotAuthenticated'))
+    }
+    return authHeader
+  }
+
   const fetchBalance = async (): Promise<GetCustomerBalanceResponse | null> => {
     isFetchingBalance.value = true
     try {
@@ -534,7 +550,9 @@ export const useAuthStore = defineStore('auth', () => {
     sendPasswordReset,
     updatePassword: _updatePassword,
     getAuthHeader,
+    getAuthHeaderOrThrow,
     getFirebaseAuthHeader,
+    getFirebaseAuthHeaderOrThrow,
     getAuthToken
   }
 })