Cleanup: delete dead code, fix invalidateFunctions bug, deduplicate

Deleted:
- runtime/index.ts (146 lines) — never imported by anything
- httpFunctionCall + _csrClient cache — redundant third HTTP path
- 3 duplicate getCSRFToken() implementations → shared utils.ts

Fixed:
- invalidateFunctions() was ignoring function names and invalidating
  ALL mounted contexts. Now correctly passes names through.

33 React tests pass.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

packages/mizan-react/src/client/index.ts

@@ -148,19 +148,7 @@ export class HttpError extends Error {
 // Internal Utilities
 // =============================================================================
 
-function getCookie(name: string): string | null {
-    if (typeof document === 'undefined') return null
-    const value = `; ${document.cookie}`
-    const parts = value.split(`; ${name}=`)
-    if (parts.length === 2) {
-        return parts.pop()?.split(';').shift() ?? null
-    }
-    return null
-}
-
-function getCSRFToken(): string | null {
-    return getCookie('csrftoken')
-}
+import { getCSRFToken } from '../utils'
 
 interface RequestBuild {
     request: RequestInit
@@ -537,49 +525,3 @@ export interface FunctionSuccessResponse<T> {
  */
 export type FunctionResponse<T> = FunctionSuccessResponse<T> | FunctionErrorResponse
 
-// Cached CSR client for server function calls
-let _csrClient: DjangoHTTPClient | null = null
-
-function getCSRClient(): DjangoHTTPClient {
-    if (!_csrClient) {
-        _csrClient = createDjangoCSRClient(Auth.SESSION)
-    }
-    return _csrClient
-}
-
-/**
- * Call a Django server function via HTTP.
- * Used as fallback when WebSocket is unavailable.
- *
- * Uses the standard CSR client with session-based auth.
- *
- * @param baseUrl - Base URL for the API (e.g., '/api/mizan')
- * @param functionName - Name of the server function
- * @param input - Input data for the function
- * @returns Promise resolving to the function output
- * @throws FunctionErrorResponse on failure
- */
-export async function httpFunctionCall<TInput = unknown, TOutput = unknown>(
-    baseUrl: string,
-    functionName: string,
-    input?: TInput
-): Promise<TOutput> {
-    const client = getCSRClient()
-
-    // Use request() not json() because server functions return { error: true/false }
-    // in the body, not HTTP status codes for business errors
-    const response = await client.request(
-        'POST',
-        `${baseUrl}/call/`,
-        { fn: functionName, args: input }
-    )
-
-    const data: FunctionResponse<TOutput> = await response.json()
-
-    if (data.error) {
-        throw new DjangoError(data)
-    }
-
-    return (data as FunctionSuccessResponse<TOutput>).result
-}
-