Address the P1 maintainability finding that trip-publish.js reimplemented post-form.js's apiSend + login-expired error copy verbatim. Extract both into js/src/api-utils.js and import from both entry points; esbuild inlines the module into each bundle so there is no runtime coupling. Also drops the stale data-trip-route reference from trip-publish.js's markup-contract comment. Rebuilt js/trip-publish.js and js/post/post-form.js. Verified: trip-publish suite 8/8; post suite unchanged (34 pass, same 6 owner-gate environmental fails as baseline — photo-editor specs that exercise post-form's apiSend/apiErrorMsg all green). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Mpdu3Dt1iVoozHwAMyjrbn