fix: initialize CSRF cookies by calling Studio base URL

[pganesh-apphelix]

No description provided.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.69%. Comparing base (5778876) to head (d3cf40f).
⚠️ Report is 1 commits behind head on master.

Additional details and impacted files

@@           Coverage Diff           @@
##           master       #7   +/-   ##
=======================================
  Coverage   94.69%   94.69%           
=======================================
  Files        1204     1204           
  Lines       26854    26854           
  Branches     6025     6026    +1     
=======================================
  Hits        25430    25430           
- Misses       1354     1365   +11     
+ Partials       70       59   -11     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Faraz32123]

LGTM!

[Copilot]

Pull Request Overview

Purpose: Initialize CSRF cookies by touching the Studio base URL before mutating (POST/PUT/PATCH/DELETE) requests.

• Adds APP_AUTH_INITIALIZED subscription that installs an axios request interceptor.
• Interceptor prefaces mutating requests with a GET to STUDIO_BASE_URL, falling back to a hidden iframe if the GET fails.

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[Copilot]

Registering the interceptor inside the event callback without a guard can lead to multiple identical interceptors if APP_AUTH_INITIALIZED fires more than once, causing duplicated priming requests. Add a flag to ensure the interceptor is added only once or store/eject the interceptor ID if re-registration is attempted.

Suggested change

	subscribe(APP_AUTH_INITIALIZED, () => {
	// Guard to ensure the interceptor is only registered once
	let interceptorRegistered = false;
	subscribe(APP_AUTH_INITIALIZED, () => {
	if (interceptorRegistered) {
	return;
	}
	interceptorRegistered = true;

[Copilot]

[nitpick] Repeated calls to getAuthenticatedHttpClient() inside the interceptor can be replaced by a captured constant (e.g., const client = getAuthenticatedHttpClient();) to make intent clearer and avoid any risk if the factory were to return a new instance in future changes.

Suggested change

	getAuthenticatedHttpClient().interceptors.request.use(async (requestConfig) => {
	const methodsToIntercept = ['post', 'put', 'delete', 'patch'];
	if (methodsToIntercept.includes(requestConfig.method?.toLowerCase())) {
	try {
	await getAuthenticatedHttpClient().get(getConfig().STUDIO_BASE_URL, {
	const client = getAuthenticatedHttpClient();
	client.interceptors.request.use(async (requestConfig) => {
	const methodsToIntercept = ['post', 'put', 'delete', 'patch'];
	if (methodsToIntercept.includes(requestConfig.method?.toLowerCase())) {
	try {
	await client.get(getConfig().STUDIO_BASE_URL, {