Epic: Dashboard, widgets and utility endpoints (no longer cookie-blocked) #116

Summary

The web product has a configurable dashboard and front wall, plus a set of sidebar widgets. The app has none, and CLAUDE.md records the layout endpoints as cookie-session-only.

Status correction — both layout endpoints now answer the bearer token

CLAUDE.md states: "GET /api/user/engagement and GET/PUT /api/user/dashboard-layout return 401 with a valid bearer token". Re-probed live 2026-09-15:

GET /api/user/dashboard-layout   -> 200 {"layout":null}
GET /api/user/front-wall-layout  -> 200 {"layout":null}
GET /api/user/engagement         -> 200 {"totalDigs":24,"totalPushes":6,"recent":[...]}

GET /api/user also returns dashboardLayout and frontWallLayout inline. This constraint in CLAUDE.md is stale and must be corrected.

Endpoints

Priority note

This is genuinely lower value for a desktop client than the social and data pillars — it is filed for completeness and because the blocking claim turned out to be wrong.

Repo conventions to follow

• Service: one partial class InterlinedApiClient file per domain in InterlinedList/Services/.
• Wire types in InterlinedList/Models/ matching real API JSON.
• ViewModel per view in InterlinedList/ViewModels/ (CommunityToolkit.Mvvm ObservableObject + [RelayCommand]).
• View is a self-contained UserControl in InterlinedList/Views/ that news up its own VM from AppServices.Session.
• Strata tokens only — no colors/fonts/radii outside Resources/Palette.xaml + Theme.*.xaml.
• Read-after-write for any mutating endpoint whose response envelope has not been live-verified.