fix: unify fetch calls to use authedFetch for protected routes

Replace plain fetch() with authedFetch() in all client-side API calls
to protected mutating and data routes. This ensures DISPATCH_AUTH_MODE=basic
operators get consistent Basic Auth header injection.

Files changed:
- src/app/automation/activity/page.tsx: events list fetch
- src/app/automation/workflows/[id]/page.tsx: workflow detail, dispatch, rerun
- src/app/agents/agent-work-panel.tsx: agent work panel CRUD operations

Left unchanged: login page session check (pre-auth, not a protected route)

Fixes #319

Author: Saffron Normal Worker

src/app/agents/agent-work-panel.tsx

@@ -1,5 +1,6 @@
 "use client";
 
+import { authedFetch } from "@/lib/client-auth";
 import { useState, useEffect, useCallback } from "react";
 import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card";
 import { Table, TableBody, TableCell, TableHead, TableHeader, TableRow } from "@/components/ui/table";
@@ -75,7 +76,7 @@ export default function AgentWorkPanel() {
 
   const fetchData = useCallback(async () => {
     try {
-      const res = await fetch(`/api/agent-work?include_stale=true`);
+      const res = await authedFetch(`/api/agent-work?include_stale=true`);
       if (res.ok) {
         const json: AgentWorkResponse = await res.json();
         setData(json);
@@ -94,7 +95,7 @@ export default function AgentWorkPanel() {
 
   const handleRelease = async (workId: string | null, leaseId?: string) => {
     try {
-      const res = await fetch("/api/agent-work", {
+      const res = await authedFetch("/api/agent-work", {
         method: "POST",
         headers: { "Content-Type": "application/json" },
         body: JSON.stringify({ action: "release", workId, leaseId, reason: "Released by operator" }),
@@ -112,7 +113,7 @@ export default function AgentWorkPanel() {
     if (!newAgent?.trim()) return;
     setReassigning(workId);
     try {
-      const res = await fetch("/api/agent-work", {
+      const res = await authedFetch("/api/agent-work", {
         method: "POST",
         headers: { "Content-Type": "application/json" },
         body: JSON.stringify({ action: "reassign", workId, newAgentName: newAgent.trim(), reason: "Reassigned by operator" }),

src/app/automation/activity/page.tsx

@@ -1,5 +1,6 @@
 "use client";
 
+import { authedFetch } from "@/lib/client-auth";
 import { useEffect, useState } from "react";
 import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card";
 import { Badge } from "@/components/ui/badge";
@@ -47,7 +48,7 @@ export default function ActivityFeedPage() {
   const [loading, setLoading] = useState(true);
 
   useEffect(() => {
-    fetch("/api/automation/events?limit=100")
+    authedFetch("/api/automation/events?limit=100")
       .then((res) => res.json())
       .then((data) => setEvents(data))
       .catch(() => setEvents([]))

src/app/automation/workflows/[id]/page.tsx

@@ -1,5 +1,6 @@
 "use client";
 
+import { authedFetch } from "@/lib/client-auth";
 import { useEffect, useState, use } from "react";
 import Link from "next/link";
 import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card";
@@ -83,7 +84,7 @@ export default function WorkflowDetailPage({ params }: { params: Promise<{ id: s
 
   useEffect(() => {
     if (!workflowId) return;
-    fetch(`/api/automation/workflows/${workflowId}`)
+    authedFetch(`/api/automation/workflows/${workflowId}`)
       .then((res) => {
         if (!res.ok) throw new Error("Workflow not found");
         return res.json();
@@ -134,7 +135,7 @@ export default function WorkflowDetailPage({ params }: { params: Promise<{ id: s
           variant="outline"
           onClick={() => {
             if (workflow.runs[0]) {
-              fetch(`/api/automation/runs/${workflow.runs[0].runId}?repo=${workflow.repo.fullName}&action=dispatch`, { method: "POST" })
+              authedFetch(`/api/automation/runs/${workflow.runs[0].runId}?repo=${workflow.repo.fullName}&action=dispatch`, { method: "POST" })
                 .then(() => window.location.reload());
             }
           }}
@@ -230,7 +231,7 @@ export default function WorkflowDetailPage({ params }: { params: Promise<{ id: s
                             variant="ghost"
                             size="sm"
                             onClick={() => {
-                              fetch(`/api/automation/runs/${run.runId}?repo=${workflow.repo.fullName}&action=rerun`, { method: "POST" })
+                              authedFetch(`/api/automation/runs/${run.runId}?repo=${workflow.repo.fullName}&action=rerun`, { method: "POST" })
                                 .then(() => window.location.reload());
                             }}
                           >