feat(frontend): add apiFetch wrapper for automatic auth token injection

Centralizes auth token management into a reusable apiFetch() helper and getAuthHeaders() utility, eliminating inline Bearer token logic across all frontend files.

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

frontend/src/lib/components/layout/NavBar.svelte

@@ -4,6 +4,7 @@
 	import { navigating, page } from '$app/stores';
 	import { resolve } from '$app/paths';
 	import { authStore } from '$lib/stores/auth.svelte';
+	import { apiFetch } from '$lib/utils/api';
 	import { Button } from '$lib/components/ui/button';
 	import { Skeleton } from '$lib/components/ui/skeleton';
 
@@ -62,9 +63,7 @@
 	async function fetchUnreadCount() {
 		if (!authStore.isAuthenticated || !authStore.currentToken) return;
 		try {
-			const res = await fetch('/api/admin/notifications/unread-count', {
-				headers: { Authorization: `Bearer ${authStore.currentToken}` }
-			});
+			const res = await apiFetch('/api/admin/notifications/unread-count');
 			if (res.ok) {
 				const data = await res.json();
 				unreadCount = data.count;