fix(ui): cookie-authed users' writes silently stranded behind bearer gates

THE CLASS: the /api JWT middleware's TokenLookup is
"cookie:token,header:Authorization:Bearer" — the token cookie always
rides same-origin fetches, so a signed-in user never needs the
localStorage bearer. But a dozen call sites gated their fetch on
`localStorage.getItem("token")` and early-returned when absent. The
global 401 interceptor CLEARS that localStorage entry on any session
rotation/blip — after which every gated write silently did nothing:
theme changes reverted on reload (the reported "can no longer change
themes", on top of the interpolation bug d5dbaa48 fixed), chain-order
selects, collection deletion, Add-to-collection submits, filter
save/load/delete, conflict actions, linking actions, stats charts,
tag suggestions, device management, admin scanner actions — all dead
for perfectly authenticated cookie users.

Fix: storage.ts exports authHeaders() (bearer when present, cookie
carries otherwise) and every gate/header site now uses it — theme.ts,
collections.ts (htmx auth, doRemoveBook/doBulkRemove, setChainOrder),
bookPicker submit, filter_builder suggestions + match count,
collection-rules apply hook, bookshelf save/load/delete filter,
conflicts x4, linking x3, admin scanner actions + polls (requireToken
removed — its "Session expired" toast fired for cookie users too),
dashboard preferences/sections, custom-section-builder, header
scanner poll, stats x3, tag suggestions, profile delete-account
(which also wrongly redirected cookie users to /login), and
device-management x4. Reads keep their graceful-empty behavior; the
bearers still ride along when present.

Pinned: the knob-matrix theme spec now REMOVES localStorage.token and
asserts the theme PUT still fires (cookie-only) and the class flips —
the exact strand that started this.

Found by noticing the panel browser's Nord click switched the class
but produced no PUT: the persistence half was gated on a token the
401 interceptor had cleared.

web/src/stats.ts

@@ -1,3 +1,4 @@
+import { authHeaders } from "./storage";
 import { Alpine } from "./alpine";
 import { showToast } from "./toast";
 import type { ChartConfiguration } from "chart.js";
@@ -213,8 +214,6 @@ function syncUrl(): void {
 // Summary fetch (Reading tab) -----------------------------------------------
 
 async function loadSummary(): Promise<void> {
-  const token = localStorage.getItem("token");
-  if (!token) return;
 
   document.getElementById("stats-empty")?.classList.add("hidden");
   const windowLabel = document.getElementById("stats-window-label");
@@ -222,7 +221,7 @@ async function loadSummary(): Promise<void> {
 
   try {
     const res = await fetch(`/api/stats/summary?range=${encodeURIComponent(currentRange)}`, {
-      headers: { Authorization: `Bearer ${token}` },
+      headers: authHeaders(),
     });
     if (res.status === 400) {
       const err = await res.json();
@@ -527,10 +526,8 @@ function renderTopBooks(books: TopBook[]): void {
 // Library tab ---------------------------------------------------------------
 
 async function loadLibraries(): Promise<VisibleLibrary[]> {
-  const token = localStorage.getItem("token");
-  if (!token) return [];
   const res = await fetch("/api/libraries/visibility", {
-    headers: { Authorization: `Bearer ${token}` },
+    headers: authHeaders(),
   });
   if (!res.ok) {
     showToast("Failed to load libraries", "error");
@@ -554,8 +551,6 @@ function fillLibrarySelector(rows: VisibleLibrary[]): void {
 
 async function loadLibraryUsage(): Promise<void> {
   if (libraryDataLoaded) return;
-  const token = localStorage.getItem("token");
-  if (!token) return;
   libraryDataLoaded = true;
 
   const qs = currentLibraryID ? `?library_id=${encodeURIComponent(currentLibraryID)}` : "";
@@ -580,7 +575,7 @@ async function loadLibraryUsage(): Promise<void> {
 
   try {
     const res = await fetch(`/api/stats/library-usage${qs}`, {
-      headers: { Authorization: `Bearer ${token}` },
+      headers: authHeaders(),
     });
     if (res.status === 403) {
       showToast("Library not visible to you", "error");