feat(spa): add typed API response mappers and contract guards

frontend/tests/angular-api-client.test.ts

@@ -189,6 +189,23 @@ describe('createAngularApiClient', () => {
     );
   });
 
+  it('returns parse error when successful payload breaks typed contract', async () => {
+    const http = {
+      get: vi.fn<AngularHttpClientLike['get']>(async <T>() => ({ ok: true } as T)),
+      post: vi.fn<AngularHttpClientLike['post']>(async <T>() => ({ ok: true } as T))
+    };
+
+    const client = createAngularApiClient(http as AngularHttpClientLike);
+    const session = await client.getSession('ABCD12');
+
+    expect(session.ok).toBe(false);
+    if (!session.ok) {
+      expect(session.status).toBe(200);
+      expect(session.error.kind).toBe('parse');
+      expect(session.error.message).toContain('Invalid API contract');
+    }
+  });
+
   it('maps HttpErrorResponse-style failures to ApiResult errors', async () => {
     const http = {
       get: vi.fn<AngularHttpClientLike['get']>(async () => {