refactor(auth): send login token through apiFetch

All authenticated calls now use apiFetch, and only utils/auth.js
touches the stored token. The cookie login can then change these two
files instead of every page.

src/App.jsx

@@ -18,6 +18,7 @@ import {Toaster} from '@/components/ui/sonner';
 import {TooltipProvider} from '@/components/ui/tooltip';
 import PageBackground from './components/PageBackground.jsx';
 import {usePreferences} from './context/PreferencesContext.jsx';
+import {clearToken, getToken} from './utils/auth.js';
 
 function App() {
     const {t} = useTranslation();
@@ -31,7 +32,7 @@ function App() {
     useEffect(() => {
         // No local expiry check here: a 401 from the backend ends the session (useSessionExpired), and a browser
         // clock that runs ahead would otherwise end it silently.
-        setIsAuthenticated(!!localStorage.getItem('tbp_jwt'));
+        setIsAuthenticated(!!getToken());
     }, [location]);
 
     // On login and on page load; the cached look shows until Auth answers.
@@ -40,7 +41,7 @@ function App() {
     }, [isAuthenticated, syncAppearance]);
 
     const handleLogout = () => {
-        localStorage.removeItem('tbp_jwt');
+        clearToken();
         resetAppearance();
         setIsAuthenticated(false);
         navigate('/login');