refactor(auth): send login token through apiFetch

All authenticated calls now use apiFetch, and only utils/auth.js
touches the stored token. The cookie login can then change these two
files instead of every page.

src/hooks/useSteamProfile.js

@@ -1,4 +1,6 @@
 import {useEffect, useState} from 'react';
+import {apiFetch} from '../utils/api.js';
+import {getToken} from '../utils/auth.js';
 
 /**
  * The user's Steam name and avatar from Core, or null while loading, without a Steam ID or on any error. Only
@@ -7,7 +9,7 @@ import {useEffect, useState} from 'react';
  */
 export default function useSteamProfile(enabled) {
     const [profile, setProfile] = useState(null);
-    const token = localStorage.getItem('tbp_jwt');
+    const token = getToken();
 
     useEffect(() => {
         if (!enabled || !token) {
@@ -17,9 +19,7 @@ export default function useSteamProfile(enabled) {
         let cancelled = false;
         (async () => {
             try {
-                const response = await fetch(`${import.meta.env.VITE_CORE_API_URL}/api/library/steam-profile`, {
-                    headers: {'Authorization': `Bearer ${token}`},
-                });
+                const response = await apiFetch(`${import.meta.env.VITE_CORE_API_URL}/api/library/steam-profile`);
                 const data = response.ok ? await response.json() : null;
                 if (!cancelled) setProfile(data);
             } catch {