refactor(admin): unify webui fetch/copy/format helpers; fix audit tab load and delete-group count

- apiFetch + shared needLogin (any 401 shows the login card) replaces six
  duplicated fetch/401/error-handling blocks in the admin composables
- useCopy composable: clipboard + execCommand fallback with timed reset,
  used by MembersPanel and WebhookPanel
- utils/format.ts (fmtTime/splitList/parseMatch) removes inline duplicates
  across SendLogs, AuditLog, RouteEditor and GroupEditor
- fix: load the audit log when the audit tab becomes active (client-side
  navigation never remounted the page, leaving the list empty on first visit)
- fix: fetch the real route count for a group before confirming deletion
  instead of reusing the currently open group's route list

app/composables/useApi.ts

@@ -0,0 +1,30 @@
+/**
+ * Shared "session expired" flag: any 401 from the admin API flips it and the
+ * console swaps to the login card. One source of truth for every composable.
+ */
+export function useAuthState() {
+  const needLogin = useState<boolean>("wh-need-login", () => false);
+  return { needLogin };
+}
+
+/**
+ * JSON fetch for same-origin admin API calls: sends credentials, treats 401
+ * as "not logged in" (flips the shared flag and throws), and surfaces the
+ * server's `{ error }` message on failure.
+ */
+export async function apiFetch<T>(path: string, init?: RequestInit): Promise<T> {
+  const res = await fetch(path, {
+    credentials: "same-origin",
+    ...init,
+    headers: { accept: "application/json", ...(init?.headers ?? {}) },
+  });
+  if (res.status === 401) {
+    useAuthState().needLogin.value = true;
+    throw new Error("unauthorized");
+  }
+  if (!res.ok) {
+    const data = (await res.json().catch(() => ({}))) as { error?: string };
+    throw new Error(data.error ?? `HTTP ${res.status}`);
+  }
+  return (await res.json()) as T;
+}