feat(frontend): add apiFetch wrapper for automatic auth token injection

Centralizes auth token management into a reusable apiFetch() helper and getAuthHeaders() utility, eliminating inline Bearer token logic across all frontend files.

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

frontend/src/lib/components/admin/BookingsCard.svelte

@@ -1,5 +1,5 @@
 <script lang="ts">
-	import { authStore } from '$lib/stores/auth.svelte';
+	import { apiFetch } from '$lib/utils/api';
 	import { SvelteDate, SvelteURLSearchParams } from 'svelte/reactivity';
 	import { toast } from 'svelte-sonner';
 
@@ -44,11 +44,10 @@
 				url = '/api/admin/bookings/search';
 			}
 
-			const response = await fetch(`${url}?${params}`, {
+			const response = await apiFetch(`${url}?${params}`, {
 				method: 'GET',
 				headers: {
-					'Content-Type': 'application/json',
-					Authorization: `Bearer ${authStore.currentToken}`
+					'Content-Type': 'application/json'
 				}
 			});
 			if (response.ok) {