refactor(auth): send login token through apiFetch

All authenticated calls now use apiFetch, and only utils/auth.js
touches the stored token. The cookie login can then change these two
files instead of every page.

src/hooks/useLibrarySync.js

@@ -1,4 +1,6 @@
 import {useEffect, useRef, useState} from 'react';
+import {apiFetch} from '../utils/api.js';
+import {getToken} from '../utils/auth.js';
 
 const POLL_INTERVAL_MS = 3000;
 const MAX_POLL_DURATION_MS = 120_000;
@@ -32,13 +34,11 @@ export default function useLibrarySync({enabled, expectInitialSync = false, onCo
         const startedAt = Date.now();
 
         const fetchOnce = async () => {
-            const token = localStorage.getItem('tbp_jwt');
-            if (!token) return;
+            if (!getToken()) return;
 
             try {
-                const response = await fetch(
-                    `${import.meta.env.VITE_CORE_API_URL}/api/library/sync-status`,
-                    {headers: {'Authorization': `Bearer ${token}`}}
+                const response = await apiFetch(
+                    `${import.meta.env.VITE_CORE_API_URL}/api/library/sync-status`
                 );
                 if (cancelled) return;