develop full initial module

Frontend/erp-system/lib/api-client.ts

@@ -50,10 +50,13 @@ export function readCsrfToken(): string | null {
 async function rawRequest(path: string, options: RequestOptions = {}): Promise<Response> {
   const { body, ifMatch, idempotencyKey, csrf, headers, ...rest } = options
   const csrfToken = csrf ? readCsrfToken() : null
+  // Multipart uploads (attendance files, staff documents) pass a FormData body — the
+  // browser sets its own Content-Type (with boundary), and it must never be JSON-encoded.
+  const isFormData = typeof FormData !== "undefined" && body instanceof FormData
 
   const finalHeaders: Record<string, string> = {
     Accept: "application/json",
-    ...(body !== undefined ? { "Content-Type": "application/json" } : {}),
+    ...(body !== undefined && !isFormData ? { "Content-Type": "application/json" } : {}),
     ...(ifMatch ? { "If-Match": ifMatch } : {}),
     ...(idempotencyKey ? { "Idempotency-Key": idempotencyKey } : {}),
     ...(csrfToken ? { "X-XSRF-TOKEN": csrfToken } : {}),
@@ -64,7 +67,7 @@ async function rawRequest(path: string, options: RequestOptions = {}): Promise<R
     ...rest,
     credentials: "include", // sends erp_at; the whole auth story depends on this
     headers: finalHeaders,
-    body: body !== undefined ? JSON.stringify(body) : undefined,
+    body: isFormData ? (body as FormData) : body !== undefined ? JSON.stringify(body) : undefined,
   })
 
   if (!response.ok) {