feat(frontend): add apiFetch wrapper for automatic auth token injection

Centralizes auth token management into a reusable apiFetch() helper and getAuthHeaders() utility, eliminating inline Bearer token logic across all frontend files.

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

frontend/src/routes/+layout.svelte

@@ -30,6 +30,10 @@
 	});
 
 	// Verify email address
+	// TODO: `/api/verify-email` doesn't exist in the backend. The correct endpoints are
+	// `POST /api/verify/generate` (send verification code) and `POST /api/verify/check` (verify code).
+	// This call silently 404s. Fix required — either add the missing backend route or refactor
+	// to use `/api/verify/generate` + `/api/verify/check`.
 	async function verify_email() {
 		const loadingToast = toast.loading('Verifying email address...');
 		const response = await fetch('/api/verify-email', {