refactor(frontend): ApiError interface, tempIdSuffix rename, NET_GRID constants, extract onPaletteDrop handlers

ApiError: defined once in utils/api.ts, replaces 9 ad-hoc anonymous casts
across MazeNET, Inspector, DeckyFleet, SwarmHosts, Webhooks, PersonaGeneration,
ServiceConfigFields, CanaryTokens.

hex4 renamed to tempIdSuffix — the name now matches the comment that already
explained its purpose.

NET_GRID_{W,H,GAP,COLS} extracted from inline magic numbers to module-level
constants in MazeNET.tsx.

onPaletteDrop (130-line useCallback) split into three module-level handlers
(_dropNetwork, _dropArchetype, _dropService); the callback becomes a 10-line
router.

decnet_web/src/components/PersonaGeneration.tsx

@@ -3,7 +3,7 @@ import { useParams } from 'react-router-dom';
 import {
   Mail, Plus, Pencil, Trash2, Check, AlertTriangle, Upload, Download, Sparkles,
 } from '../icons';
-import api from '../utils/api';
+import api, { type ApiError } from '../utils/api';
 import { useToast } from './Toasts/useToast';
 import Modal from './Modal/Modal';
 import './DeckyFleet.css';
@@ -53,10 +53,7 @@ const LATENCIES: ReplyLatency[] = ['fast', 'normal', 'slow'];
 type FilterKey = 'all' | Tone;
 
 function extractErrorDetail(err: unknown, fallback: string): string {
-  const e = err as {
-    response?: { status?: number; data?: { detail?: string } };
-    message?: string;
-  };
+  const e = err as ApiError;
   if (e?.response?.data?.detail) return e.response.data.detail;
   if (e?.response?.status === 403) return 'Insufficient permissions (admin only)';
   if (e?.response?.status === 401) return 'Session expired — please log in again';