feat(frontend): add apiFetch wrapper for automatic auth token injection

Centralizes auth token management into a reusable apiFetch() helper and getAuthHeaders() utility, eliminating inline Bearer token logic across all frontend files.

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

frontend/src/routes/admin/+page.svelte

@@ -1,6 +1,7 @@
 <script lang="ts">
 	import { goto } from '$app/navigation';
 	import { authStore } from '$lib/stores/auth.svelte';
+	import { apiFetch } from '$lib/utils/api';
 	import { browser } from '$app/environment';
 	import { Skeleton } from '$lib/components/ui/skeleton';
 
@@ -122,14 +123,9 @@
 		async function loadSharedData() {
 			try {
 				const [hoursRes, servicesRes] = await Promise.all([
-					fetch('/api/scheduling/default-hours', {
-						headers: { Authorization: `Bearer ${authStore.currentToken}` }
-					}),
-					fetch('/api/admin/services', {
-						headers: {
-							'Content-Type': 'application/json',
-							Authorization: `Bearer ${authStore.currentToken}`
-						}
+					apiFetch('/api/scheduling/default-hours'),
+					apiFetch('/api/admin/services', {
+						headers: { 'Content-Type': 'application/json' }
 					})
 				]);
 
@@ -165,6 +161,10 @@
 <svelte:head>
 	<script>
 		(function () {
+			// Pre-hydration auth guard: reads localStorage directly because the Svelte
+			// authStore hasn't initialized yet at this point (async+$state). This runs
+			// synchronously in <svelte:head> before any rendering, preventing a flash
+			// of protected content. The authStore handles post-hydration auth.
 			try {
 				var token = localStorage.getItem('authToken');
 				if (!token) {
@@ -340,11 +340,8 @@
 						onRefresh={async () => {
 							if (!browser) return;
 							try {
-								const r = await fetch('/api/admin/services', {
-									headers: {
-										'Content-Type': 'application/json',
-										Authorization: `Bearer ${authStore.currentToken}`
-									}
+								const r = await apiFetch('/api/admin/services', {
+									headers: { 'Content-Type': 'application/json' }
 								});
 								if (r.ok) {
 									services = await r.json();