Keep mocks in src/mocks, typed against generated types, cloned before returning mutable data, and selected only in the API service. Cover success, error, empty, loading, login failure, and protected feature behavior without changing production request flow.