fix(ui): encode every id in API paths (client-side path traversal)

Follow-up to a7609ff for the whole frontend: all 30 API helpers in
src/lib now pass path values through encodeURIComponent, so an id taken
from the URL can never leave its own path segment and make the page call
another endpoint with the viewer's token.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

ApiCore-Frontend/src/lib/treatments/api.ts

@@ -8,7 +8,7 @@ import {
 } from "./types";
 
 export function fetchColonyTreatments(colonyId: string): Promise<Treatment[]> {
-  return apiFetch<Treatment[]>(`/colonies/${colonyId}/treatments`);
+  return apiFetch<Treatment[]>(`/colonies/${encodeURIComponent(colonyId)}/treatments`);
 }
 
 export function fetchWithdrawalStatus(
@@ -37,7 +37,7 @@ export function updateTreatment(
   id: string,
   input: UpdateTreatmentInput,
 ): Promise<Treatment> {
-  return apiFetch<Treatment>(`/treatments/${id}`, {
+  return apiFetch<Treatment>(`/treatments/${encodeURIComponent(id)}`, {
     method: "PATCH",
     body: JSON.stringify(input),
   });