fix(web): acquire bearer token in useEntityForm before create/update

[christopherhouse]

Summary

POST/PUT against /api/registry from the spec-006 registry forms (namespace create, queue/topic/sub/rule create + edit) returned 401 with no Bearer header on the request. useEntityForm accepted an apiOptions prop carrying the access token, but neither namespace-form.tsx nor child-entity-form.tsx ever passed it. The registry api client builds headers without Authorization: Bearer when options.accessToken is undefined, so the backend's RequireAuthorization() gate (FR-037 AuthN-only) returned 401 before any handler ran.

Same pattern as the spec-008 namespace forms which already use useAcquireToken() internally — this fix brings the spec-006 form hook up to the same standard.

Fix

Inside useEntityForm:

const getToken = useAcquireToken();
// ...inside submit:
let resolvedApiOptions = apiOptions;
if (!resolvedApiOptions?.accessToken) {
  const token = await getToken();
  if (token) {
    resolvedApiOptions = { ...(apiOptions ?? {}), accessToken: token };
  }
}
// then pass resolvedApiOptions to createEntity / updateEntity

External callers can still pass apiOptions.accessToken to override (the explicit-token path is documented in web/lib/api-client.ts).

Test plan

• pnpm typecheck clean
• After CD-dev rolls forward: open Namespace Create form on /registry, submit, expect 201 (not 401)

Risk

None — additive token acquisition inside the existing submit path, no schema change, no backend change.

🤖 Generated with Claude Code