fix(dashboard): authenticate frontend API calls with X-WB-Token

[petarkrvavac]

Problem

The dashboard backend requires the per-launch X-WB-Token, but frontend API requests were being sent without the token, causing 401 Unauthorized responses.

Fix

• Add shared ensureToken() / withAuth() helpers in src/auth.ts so the frontend uses a single token cache.
• Update src/api.ts so j() and runAgent() send X-WB-Token.
• Update src/v2/api.ts so both request() and the streamEvents() SSE fetch use the same auth helper.
• Preserve the existing Accept: text/event-stream header for SSE requests.

/api/session remains unauthenticated because it is the bootstrap endpoint used to obtain the per-launch dashboard token.

Verification

• Dashboard API requests no longer return auth-related 401 responses.
• Root and V2 API calls authenticate successfully.
• SSE requests continue to work.
• npm run build succeeds.