refactor(auth): send login token through apiFetch

All authenticated calls now use apiFetch, and only utils/auth.js
touches the stored token. The cookie login can then change these two
files instead of every page.

src/pages/SettingsPage.jsx

@@ -22,6 +22,8 @@ import useSaveAppearance from '../hooks/useSaveAppearance.js';
 import {ACCENTS, CORNERS} from '../utils/appearance.js';
 import {coverUrl} from '../utils/games.js';
 import {cn} from '@/lib/utils';
+import {apiFetch} from '../utils/api.js';
+import {getToken, setToken} from '../utils/auth.js';
 
 const BACKEND_ERROR_KEY = {
     STEAM_ID_ALREADY_IN_USE: 'REGISTRATION.ERROR_STEAM_ID_IN_USE',
@@ -61,18 +63,16 @@ export default function SettingsPage() {
     });
 
     useEffect(() => {
-        const token = localStorage.getItem('tbp_jwt');
-        if (!token) {
+        if (!getToken()) {
             navigate('/login');
             return;
         }
 
         const load = async () => {
             try {
-                const response = await fetch(`${import.meta.env.VITE_API_URL}/api/users/me?v=1`, {
+                const response = await apiFetch(`${import.meta.env.VITE_API_URL}/api/users/me?v=1`, {
                     method: 'GET',
                     headers: {
-                        'Authorization': `Bearer ${token}`,
                         'Content-Type': 'application/json',
                     },
                 });
@@ -107,17 +107,15 @@ export default function SettingsPage() {
     }, [navigate, expireSession, reset, t]);
 
     const persistSettings = async (payload) => {
-        const token = localStorage.getItem('tbp_jwt');
-        if (!token) {
+        if (!getToken()) {
             navigate('/login');
             return {ok: false};
         }
 
         try {
-            const response = await fetch(`${import.meta.env.VITE_API_URL}/api/users/settings`, {
+            const response = await apiFetch(`${import.meta.env.VITE_API_URL}/api/users/settings`, {
                 method: 'PUT',
                 headers: {
-                    'Authorization': `Bearer ${token}`,
                     'Content-Type': 'application/json',
                 },
                 body: JSON.stringify(payload),
@@ -136,7 +134,7 @@ export default function SettingsPage() {
             }
 
             const data = await response.json();
-            localStorage.setItem('tbp_jwt', data.token); // Core reads the steamId from the token
+            setToken(data.token); // Core reads the steamId from the token
             toast.success(t('SETTINGS.SAVED'));
             return {ok: true};
         } catch (err) {