refactor(auth): send login token through apiFetch

All authenticated calls now use apiFetch, and only utils/auth.js
touches the stored token. The cookie login can then change these two
files instead of every page.

src/pages/PlayNextPage.jsx

@@ -13,6 +13,8 @@ import PageContainer from '../components/PageContainer.jsx';
 import useSessionExpired from '../hooks/useSessionExpired.js';
 import {saveGameStatus} from '../utils/backlog.js';
 import {formatPlaytime} from '../utils/games.js';
+import {apiFetch} from '../utils/api.js';
+import {getToken} from '../utils/auth.js';
 
 // maxMinutes is IGDB's normal time to beat; a limit leaves out games without IGDB data.
 const BUDGETS = [
@@ -45,8 +47,7 @@ export default function PlayNextPage() {
     const latestRequest = useRef(0);
 
     const load = useCallback(async (maxMinutes, exclude) => {
-        const token = localStorage.getItem('tbp_jwt');
-        if (!token) {
+        if (!getToken()) {
             navigate('/login');
             return;
         }
@@ -54,9 +55,8 @@ export default function PlayNextPage() {
         setLoading(true);
         setError(null);
         try {
-            const response = await fetch(
-                `${import.meta.env.VITE_CORE_API_URL}/api/library/picker?${pickerQuery(maxMinutes, exclude)}`,
-                {headers: {'Authorization': `Bearer ${token}`}});
+            const response = await apiFetch(
+                `${import.meta.env.VITE_CORE_API_URL}/api/library/picker?${pickerQuery(maxMinutes, exclude)}`);
             if (request !== latestRequest.current) return;
             if (response.status === 401) {
                 expireSession();