feat: add request code generator modal supporting cURL, fetch, axios,…

[ayash911]

Changes

Adds a code generator panel to convert any request into ready-to-use snippets (#775):

• Added CodeGeneratorModal UI featuring a clean sidebar selector for languages.
• Implemented code-generator-service to export requests as cURL commands, JS/TS fetch, Axios, and Python requests.
• Substitutes active environment variables {{variable}} and resolved auth credentials recursively.
• GitHub-style floating copy button with instant success feedback.

Closes #775

Testing

• Created unit tests in code-generator-service.test.ts for all target generators.
• Verified variable resolution, auth header generation, and UI layout inside Electron.

Checklist

• Issue has been linked to this PR
• Code has been reviewed by person creating the PR
• Automated tests have been written, if possible
• Manual testing has been performed
• Documentation has been updated, if necessary
• Changes have been reviewed by second person

[giemic8]

Thanks @ayash911 — the modal UX and the breadth of generators are nice, and having unit tests per target is the right instinct. My main concerns are architectural and one is a security issue, detailed inline.

Architecture — the central issue: the renderer re-derives request semantics that already exist in the main process.

• getAuthHeader reimplements basic/bearer/oauth2/inherit header generation that environmentService.getAuthorizationHeader (main) already does, including variable substitution. Two copies of security-sensitive logic will drift, and this copy already misses cases: OAuth2 only reads a cached tokens.access_token (empty until a real send), client-credentials/PKCE flows aren't handled, and there's no mTLS/API-key awareness.
• resolveTemplateVariables is a third template engine alongside the existing renderer template infra and main's setVariablesInString. It only sees the env vars passed in — not collection variables, secrets, or system/dynamic vars — so a generated snippet can differ from what the app actually sends. The whole point of a code generator is fidelity to the real request.

The robust design is to resolve the request once, through the existing pipeline, and have the generators consume an already-resolved (url, headers, body) tuple. The per-language functions then only do string formatting, not auth/variable logic. That also removes the any types (see below) because they'd operate on resolved primitives.

Type safety. auth: any, collectionAuth: any and const variables: any (test) violate the no-any rule in CLAUDE.md/AGENTS.md. The proper types exist: AuthorizationInformation / AuthorizationType enum, Collection['auth'], VariableObject. The string literals 'basic'|'bearer'|'oauth2'|'inherit' happen to match the enum values today, so it works by luck — use the enum.

Security. See the inline note — resolved secrets get baked into the snippet, and the modal advertises it "for integration or sharing."

Scope. MainTopBar.tsx contains save-shortcut changes unrelated to code generation that look like regressions — flagged inline. And there's the same unrelated formatting churn as #887 (auth-code-flow.ts, SidebarRequestList.tsx, template-variable-semantic-tokens-provider.ts) — please drop it.

Coverage gap. A FILE body type produces a snippet with no body in the non-form generators (cURL/fetch/axios/python only handle TEXT and FORM_DATA). Either handle it or note it as unsupported.

[giemic8]

This is a third template-variable engine in the codebase, parallel to the existing renderer template infrastructure and main's environmentService.setVariablesInString. It only resolves the env vars passed into the modal — not collection variables, secrets, or system/dynamic variables — so the generated snippet can diverge from what the app actually sends. A code generator's value is fidelity; please resolve through the existing pipeline rather than a fresh regex.

[giemic8]

Architecture + types. This duplicates environmentService.getAuthorizationHeader (main), which already handles basic/bearer/oauth2/inherit with variable substitution. Two copies of auth logic will drift, and this one is already thinner: OAuth2 only reads a cached tokens.access_token (empty until a real request runs), and the client-credentials/auth-code/PKCE flows aren't covered.

Also: auth: any / collectionAuth?: any violate the no-any rule (CLAUDE.md). Use AuthorizationInformation and the AuthorizationType enum instead of the string literals 'basic'|'bearer'|'oauth2'|'inherit' — they match the enum values only by coincidence today.

[giemic8]

Security. This resolves auth credentials and secret variables into the snippet as plaintext — Basic base64, bearer/OAuth tokens, and any secret env var. The modal subtitle says the snippet is "for integration or sharing," so a user copying it will leak live secrets into chats/docs/repos. Please either keep {{variable}} placeholders unresolved by default (with an opt-in to inline), mask secret-typed variables, or at minimum show a clear warning. Worth a /security-review before merge.

[giemic8]

Out of scope for a code-generator PR, and looks like a regression: the previous code did updateRequest(await eventService.saveChanges(request), true) so the store received the saved request and cleared the draft flag. Now it just await eventService.saveChanges(request) and discards the result, so the UI state won't reflect the save. The if (request == null) return; guard was also dropped, so this can call saveChanges(null). Please revert these unrelated changes or split them into their own PR with justification.

[giemic8]

Also unrelated to code generation and a behavior change: the old handler only saved when request?.draft was true and used event.key.toLowerCase() === 's'. Now it saves on every Cmd/Ctrl+S regardless of draft state, and e.key === 's' won't match when Shift is held (key becomes 'S'). Please keep these out of this PR.

[giemic8]

Hardcoded hex colors (bg-[#141517], #16181a, #1e1e1e, text-purple-400, #c084fc, #a855f7, bg-green-950/...) bypass the project's CSS-variable theme tokens used everywhere else. This won't adapt to the light theme and is inconsistent with the convention called out on the other UI work. Please use the existing theme tokens / Tailwind theme colors.