fix(ui): cookie-authed users' writes silently stranded behind bearer gates

THE CLASS: the /api JWT middleware's TokenLookup is
"cookie:token,header:Authorization:Bearer" — the token cookie always
rides same-origin fetches, so a signed-in user never needs the
localStorage bearer. But a dozen call sites gated their fetch on
`localStorage.getItem("token")` and early-returned when absent. The
global 401 interceptor CLEARS that localStorage entry on any session
rotation/blip — after which every gated write silently did nothing:
theme changes reverted on reload (the reported "can no longer change
themes", on top of the interpolation bug d5dbaa48 fixed), chain-order
selects, collection deletion, Add-to-collection submits, filter
save/load/delete, conflict actions, linking actions, stats charts,
tag suggestions, device management, admin scanner actions — all dead
for perfectly authenticated cookie users.

Fix: storage.ts exports authHeaders() (bearer when present, cookie
carries otherwise) and every gate/header site now uses it — theme.ts,
collections.ts (htmx auth, doRemoveBook/doBulkRemove, setChainOrder),
bookPicker submit, filter_builder suggestions + match count,
collection-rules apply hook, bookshelf save/load/delete filter,
conflicts x4, linking x3, admin scanner actions + polls (requireToken
removed — its "Session expired" toast fired for cookie users too),
dashboard preferences/sections, custom-section-builder, header
scanner poll, stats x3, tag suggestions, profile delete-account
(which also wrongly redirected cookie users to /login), and
device-management x4. Reads keep their graceful-empty behavior; the
bearers still ride along when present.

Pinned: the knob-matrix theme spec now REMOVES localStorage.token and
asserts the theme PUT still fires (cookie-only) and the class flips —
the exact strand that started this.

Found by noticing the panel browser's Nord click switched the class
but produced no PUT: the persistence half was gated on a token the
401 interceptor had cleared.

tests/ui/knob_matrix.spec.ts

@@ -159,6 +159,31 @@ test("theme picker: every click persists and flips the body class", async ({ pag
   await page.locator('.theme-btn[data-theme="tokyo-night"]').click();
   await back;
   expectNoNewConsoleErrors();
+
+  // THE STRAND-CLASS REGRESSION PIN: the global 401 interceptor can
+  // clear the localStorage bearer (session rotation); theme saves must
+  // ride the token COOKIE (middleware TokenLookup checks cookie first)
+  // — never gated on localStorage ("can no longer change themes",
+  // 2026-10-31: the save early-returned without a bearer and every
+  // reload re-rendered the old server theme).
+  await page.evaluate(() => localStorage.removeItem("token"));
+  await appearance.click();
+  const putNord = page.waitForRequest(
+    (r) => r.method() === "PUT" && r.url().includes("/api/auth/theme"),
+  );
+  await page.locator('.theme-btn[data-theme="nord"]').click();
+  expect((await putNord).postDataJSON()).toEqual({ theme: "nord" });
+  await expect.poll(() => page.locator("body").getAttribute("class")).toContain("theme-nord");
+
+  // Restore the default — also via cookie, proving persistence works
+  // without any localStorage bearer at all.
+  await appearance.click();
+  const putBack = page.waitForRequest(
+    (r) => r.method() === "PUT" && r.url().includes("/api/auth/theme"),
+  );
+  await page.locator('.theme-btn[data-theme="tokyo-night"]').click();
+  await putBack;
+  expectNoNewConsoleErrors();
 });
 
 test("pencil glyph vs card body: modal stays, card navigates", async ({ page }) => {