feat(frontend): add apiFetch wrapper for automatic auth token injection

Centralizes auth token management into a reusable apiFetch() helper and getAuthHeaders() utility, eliminating inline Bearer token logic across all frontend files.

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

frontend/src/lib/components/admin/WeeklySchedule.svelte

@@ -1,7 +1,7 @@
 <script lang="ts">
-	import { authStore } from '$lib/stores/auth.svelte';
 	import { toast } from 'svelte-sonner';
 	import { browser } from '$app/environment';
+	import { apiFetch } from '$lib/utils/api';
 
 	// shadcn-svelte components
 	import { Button } from '$lib/components/ui/button';
@@ -109,11 +109,9 @@
 		let error = null;
 
 		try {
-			const response = await fetch('/api/scheduling/default-hours', {
-				method: 'GET',
+			const response = await apiFetch('/api/scheduling/default-hours', {
 				headers: {
-					'Content-Type': 'application/json',
-					Authorization: `Bearer ${authStore.currentToken}`
+					'Content-Type': 'application/json'
 				}
 			});
 
@@ -168,11 +166,10 @@
 				isOpen: hour.is_open
 			}));
 
-			const response = await fetch('/api/scheduling/default-hours', {
+			const response = await apiFetch('/api/scheduling/default-hours', {
 				method: 'PUT',
 				headers: {
-					'Content-Type': 'application/json',
-					Authorization: `Bearer ${authStore.currentToken}`
+					'Content-Type': 'application/json'
 				},
 				body: JSON.stringify(payload)
 			});