refactor(deco-apps): delegate to the shared Supabase REST helper

[pedrofrxncx]

Source: C1 dedup — apps/api/src/api/routes/deco-apps.ts hand-rolled its own fetch + check-and-throw Supabase REST call (supabaseGetApps), duplicating the exact pattern apps/api/src/deco-legacy/supabase.ts's supabaseGet(url, key, path) already generalizes (this is the same fetch/error-handling shape the repo has consolidated once before, per the deco-legacy bug hunt this tick).

Why a maintainer wants it: one fewer hand-rolled HTTP client to keep in sync with the shared one — this local copy had drifted to a second, redundant 10s timeout constant instead of reusing the shared 15s REQUEST_TIMEOUT_MS. Fewer near-duplicate fetch wrappers means fewer places a future auth/timeout/error-shape fix has to be applied twice.

Net line delta: -25 / +6 (removed the local supabaseGetApps function and its dedicated timeout constant, replaced the one call site with supabaseGet<SupabaseAppRow>(...)).

Behavior confirmed unchanged: same REST query string (apps?select=name,title,description,logo,category,vendors(alias,url)), same thrown Error("External service error (<status>)") on a non-2xx response, same 502 surfaced to the caller. The only difference is the console.error log body is no longer truncated to 200 chars (supabaseGet logs the full response text) — a log-verbosity change, not a behavior change.

Command a reviewer runs: bun test apps/api/src/api/routes/deco-apps.test.ts (covers mapSupabaseAppRows and the auth-guard route, unaffected by this change) and cd apps/api && bunx tsc --noEmit.

Verified locally: bun run fmt, cd apps/api && bunx tsc --noEmit (clean), bun test apps/api/src/api/routes/deco-apps.test.ts (2 pass), bunx oxlint apps/api/src/api/routes/deco-apps.ts (0 warnings/errors). Full CI validates the rest.

---

Summary by cubic

Delegates the deco-apps Supabase REST call to the shared supabaseGet helper to remove a duplicate fetch + timeout implementation. Behavior stays the same; only logs now include the full response body instead of a 200‑char truncation.

• Removes local supabaseGetApps and its 10s timeout; uses the shared 15s REQUEST_TIMEOUT_MS via supabaseGet from apps/api/src/deco-legacy/supabase.ts.
• Preserves the query string, thrown error message, and surfaced 502 on non-2xx responses.
• Affects apps/api/src/api/routes/deco-apps.ts only; no migrations required.
• Verify with: bun test apps/api/src/api/routes/deco-apps.test.ts and cd apps/api && bunx tsc --noEmit.

^{Written for commit 0798559. Summary will update on new commits.}