fix(gui): gate the client-config fetch behind an explicit cancel flag

React Doctor flagged the setter after `await` in the panel's effect. The
write was already safe — every result carries its request key and a
superseded run's key no longer matches — but the guard was an
`AbortController.signal.aborted` check, which states "the request was
cancelled", not "this run may no longer write".

An explicit `cancelled` flag set in the cleanup makes the invariant local
to the setter, so a reader (and the linter) can see why a stale resolve
cannot land. The abort stays: it stops the in-flight request, the flag
stops the write.

Author: lidge-jun

gui/src/components/apikeys-workspace/ClientConfigPanel.tsx

@@ -62,22 +62,30 @@ export default function ClientConfigPanel({
 
   useEffect(() => {
     const controller = new AbortController();
+    // `cancelled` is what actually gates the setters. The abort signal alone left the
+    // guard implicit — a reader (and react-doctor's no-set-state-after-await-in-effect)
+    // cannot tell from the setter call that a superseded run can no longer write. Both
+    // stay: abort stops the in-flight request, this flag stops the write.
+    let cancelled = false;
     void (async () => {
       try {
         const res = await fetch(`${apiBase}/api/client-config?client=${encodeURIComponent(client)}`, {
           signal: controller.signal,
         });
         if (!res.ok) throw new Error(await apiErrorMessage(res, t("api.clientConfig.loadFailed")));
         const envelope = await res.json() as ClientConfigEnvelope;
-        if (controller.signal.aborted) return;
+        if (cancelled) return;
         setResult({ key: requestKey, data: envelope, error: null });
       } catch (cause) {
-        if (controller.signal.aborted) return;
+        if (cancelled) return;
         const message = cause instanceof Error && cause.message ? cause.message : t("api.clientConfig.loadFailed");
         setResult({ key: requestKey, data: null, error: message });
       }
     })();
-    return () => controller.abort();
+    return () => {
+      cancelled = true;
+      controller.abort();
+    };
   }, [apiBase, client, requestKey, t]);
 
   const settled = result !== null && result.key === requestKey ? result : null;