refactor(auth): send login token through apiFetch

All authenticated calls now use apiFetch, and only utils/auth.js
touches the stored token. The cookie login can then change these two
files instead of every page.

src/hooks/useForceSync.js

@@ -3,6 +3,8 @@ import {useNavigate} from 'react-router-dom';
 import {useTranslation} from 'react-i18next';
 import {toast} from 'sonner';
 import useSessionExpired from './useSessionExpired.js';
+import {apiFetch} from '../utils/api.js';
+import {getToken} from '../utils/auth.js';
 
 const RELOAD_DELAY_MS = 4000;
 
@@ -17,16 +19,14 @@ export default function useForceSync(onStarted) {
     const [busy, setBusy] = useState(false);
 
     const trigger = async () => {
-        const token = localStorage.getItem('tbp_jwt');
-        if (!token) {
+        if (!getToken()) {
             navigate('/login');
             return;
         }
         setBusy(true);
         try {
-            const response = await fetch(`${import.meta.env.VITE_CORE_API_URL}/api/library/sync`, {
+            const response = await apiFetch(`${import.meta.env.VITE_CORE_API_URL}/api/library/sync`, {
                 method: 'POST',
-                headers: {'Authorization': `Bearer ${token}`},
             });
             if (response.status === 401) {
                 expireSession();