use the context's client to expand a folder

A bare fetch was returning 401: Officer's API authenticates with a bearer token,
not a cookie, and only the hook holds it. The browser now supplies an
authenticated client in the action's context.

web/file-actions.ts

@@ -43,7 +43,7 @@ export const fileActions: FileAction[] = [
       const directories = entries.filter((entry) => entry.type === 'directory').length;
       return directories === 0 || (directories === 1 && entries.length === 1);
     },
-    run: async (entries) => {
+    run: async (entries, context) => {
       /*
         A folder is expanded into the files inside it.
 
@@ -59,12 +59,17 @@ export const fileActions: FileAction[] = [
 
       let paths = chosen;
       if (entries.length === 1 && entries[0]!.type === 'directory') {
-        const response = await fetch(
-          `/api/fofos-admin/_config/media/files?path=${encodeURIComponent(chosen[0] ?? '')}`,
-          { credentials: 'same-origin' },
-        ).catch(() => null);
+        /*
+          The context's client, not `fetch`.
+
+          A bare fetch returns 401: this API authenticates with a bearer token rather than a cookie, and
+          only the hook holds it — which `run` cannot call, being an event handler outside React. So the
+          browser hands one over.
+        */
+        const body = await context.client
+          .get<{ files?: string[] }>(`/fofos-admin/_config/media/files?path=${encodeURIComponent(chosen[0] ?? '')}`)
+          .catch(() => null);
 
-        const body = response?.ok ? ((await response.json()) as { files?: string[] }) : null;
         // Falling back to the folder itself would create the wrong gallery quietly. Nothing is better.
         if (!body?.files?.length) return;
         paths = body.files;