fix(ui): cookie-authed users' writes silently stranded behind bearer gates

THE CLASS: the /api JWT middleware's TokenLookup is
"cookie:token,header:Authorization:Bearer" — the token cookie always
rides same-origin fetches, so a signed-in user never needs the
localStorage bearer. But a dozen call sites gated their fetch on
`localStorage.getItem("token")` and early-returned when absent. The
global 401 interceptor CLEARS that localStorage entry on any session
rotation/blip — after which every gated write silently did nothing:
theme changes reverted on reload (the reported "can no longer change
themes", on top of the interpolation bug d5dbaa48 fixed), chain-order
selects, collection deletion, Add-to-collection submits, filter
save/load/delete, conflict actions, linking actions, stats charts,
tag suggestions, device management, admin scanner actions — all dead
for perfectly authenticated cookie users.

Fix: storage.ts exports authHeaders() (bearer when present, cookie
carries otherwise) and every gate/header site now uses it — theme.ts,
collections.ts (htmx auth, doRemoveBook/doBulkRemove, setChainOrder),
bookPicker submit, filter_builder suggestions + match count,
collection-rules apply hook, bookshelf save/load/delete filter,
conflicts x4, linking x3, admin scanner actions + polls (requireToken
removed — its "Session expired" toast fired for cookie users too),
dashboard preferences/sections, custom-section-builder, header
scanner poll, stats x3, tag suggestions, profile delete-account
(which also wrongly redirected cookie users to /login), and
device-management x4. Reads keep their graceful-empty behavior; the
bearers still ride along when present.

Pinned: the knob-matrix theme spec now REMOVES localStorage.token and
asserts the theme PUT still fires (cookie-only) and the class flips —
the exact strand that started this.

Found by noticing the panel browser's Nord click switched the class
but produced no PUT: the persistence half was gated on a token the
401 interceptor had cleared.

web/src/bookshelf.ts

@@ -1,5 +1,6 @@
 // Bookshelf functionality - procedural/imperative style
 
+import { authHeaders } from "./storage";
 import { Alpine } from "./alpine";
 import { showToast } from "./toast";
 import type { FilterGroupState, FilterRuleState } from "./filter_builder";
@@ -183,11 +184,6 @@ Alpine.data("bookshelf", () => ({
   // The qf engine then drives it everywhere — shelf, collections page,
   // play chains — with zero re-authoring.
   async saveFilterAsCollection() {
-    const token = localStorage.getItem("token");
-    if (!token) {
-      showToast("Not authenticated", "error");
-      return;
-    }
     const nameInput = document.getElementById("save-filter-name") as HTMLInputElement | null;
     const name = nameInput?.value?.trim() ?? "";
     if (!name) {
@@ -203,7 +199,7 @@ Alpine.data("bookshelf", () => ({
     try {
       const response = await fetch("/api/collections", {
         method: "POST",
-        headers: { "Content-Type": "application/json", Authorization: `Bearer ${token}` },
+        headers: { ...authHeaders(), "Content-Type": "application/json" },
         body: JSON.stringify({ name, filter_tree: tree }),
       });
       if (response.ok) {
@@ -231,16 +227,11 @@ Alpine.data("bookshelf", () => ({
 
     showToast(`Loading filter: ${filterName}...`, "info");
 
-    const token = localStorage.getItem("token");
-    if (!token) {
-      showToast("Not authenticated", "error");
-      return;
-    }
 
     try {
       // Fetch filter details from API
       const response = await fetch(`/api/saved-filters/${filterId}`, {
-        headers: { Authorization: `Bearer ${token}` },
+        headers: authHeaders(),
       });
 
       if (!response.ok) {
@@ -320,16 +311,11 @@ Alpine.data("bookshelf", () => ({
 
     if (!confirm("Are you sure you want to delete this filter?")) return;
 
-    const token = localStorage.getItem("token");
-    if (!token) {
-      showToast("Not authenticated", "error");
-      return;
-    }
 
     try {
       const response = await fetch(`/api/saved-filters/${filterId}`, {
         method: "DELETE",
-        headers: { Authorization: `Bearer ${token}` },
+        headers: authHeaders(),
       });
 
       if (response.ok) {