fix(tests): fix remaining CI failures for URL.createObjectURL and Response mocking

Two root causes:

1. authUrl.test.ts (007, 011, 012): Object.defineProperty in setup.ts
   fails silently on CI when jsdom's URL.createObjectURL is
   non-configurable. vi.restoreAllMocks() in beforeEach then restores
   the property to jsdom's native implementation (returns '').
   Fix: assign URL.createObjectURL = vi.fn(() => 'blob:mock') directly
   in authUrl.test.ts's beforeEach, after restoreAllMocks(), so every
   test in the file gets a fresh, reliable mock. Remove the now-
   unnecessary mockClear() from test 012.

2. client.test.ts (013): MSW patches the global Response constructor and
   calls blob.stream() on the body — a method not implemented by jsdom's
   Blob. Fix: replace new Response(blob) with a plain-object duck-type
   ({ ok: true, blob: () => Promise.resolve(blob) }) to bypass the
   patched constructor entirely.

client/tests/integration/api/client.test.ts

@@ -334,12 +334,14 @@ describe('API client interceptors', () => {
   // ── backupApi.download ───────────────────────────────────────────────────────
 
   it('FE-API-013: backupApi.download creates a temp anchor and clicks it', async () => {
-    // backupApi.download uses native fetch (not axios), so mock it directly to
-    // avoid jsdom/MSW interception differences across environments.
+    // backupApi.download uses native fetch (not axios). Mock fetch directly and
+    // use a plain-object Response duck-type to avoid MSW patching the Response
+    // constructor (which calls blob.stream() — not implemented in jsdom's Blob).
     const blob = new Blob(['zip-bytes'], { type: 'application/zip' });
-    vi.spyOn(globalThis, 'fetch').mockResolvedValueOnce(
-      new Response(blob, { status: 200 })
-    );
+    vi.spyOn(globalThis, 'fetch').mockResolvedValueOnce({
+      ok: true,
+      blob: () => Promise.resolve(blob),
+    } as unknown as Response);
     const createObjectURL = vi.spyOn(URL, 'createObjectURL').mockReturnValue('blob:mock-url');
     const revokeObjectURL = vi.spyOn(URL, 'revokeObjectURL').mockImplementation(() => {});