Session transfer UI treats non-2xx responses as success

Description

The session-transfer UI treats non-2xx responses as successful because neither request checks response.ok or validates the expected response shape.

This is present on develop at f2cf95e06cd613fd0a06bbcb755e044c1dbfe306:

• The create flow shows success before parsing the response and later copies responseData.id
• The redeem flow reloads after parsing any JSON response
• The server intentionally returns JSON errors with 400, 404, and 410 statuses

Steps to reproduce

Create flow:

1. Visit the transfer UI without an author cookie, so POST /tokenTransfer returns 400 { "error": "No author cookie to transfer" }.
2. Click “Transfer session now”.

The button changes to a checkmark and the copy section is shown. Clicking copy writes undefined because the error body has no id.

Redeem flow:

1. Enter a syntactically valid but missing/expired transfer UUID, causing a 404 or 410 JSON response.
2. Click the transfer button.

The page reloads as if redemption succeeded.

Expected behavior

The UI should only show success or reload after a 2xx response with the expected body. For an error, it should display the server message (or a localized fallback), restore usable controls, and preserve the page state.

Possible direction

Check response.ok before the success transition, validate id/ok, and handle fetch/JSON failures in both paths.

No plugins are required. I found this while benchmarking an automated code-review workflow and manually verified the current source and duplicate search before reporting it.