[#197][#201] fix: centralize Bearer auth across non-/api requests

[Mohamed-Alkafory]

Closes #197, Closes #201

What this does

After the Keycloak migration, requests outside /api/* weren't carrying the auth token (backend no longer reads cookies). This affected report export, form POSTs (Add User, Create Ticket, etc.), and read hooks (useJson/useText, e.g. the ticket alarm status poll).

Approach (per review feedback)

Instead of patching each call site separately, centralized the fix: AuthProvider's existing fetch interceptor now covers all same-origin requests (previously /api/* only), not just a widened set of individual helpers. This eliminated duplicate token-refresh logic and let me delete the per-file workarounds entirely — api.ts, useJson, and useText are now back to plain fetch calls with no special auth wiring of their own.

Also removed the BACKEND_ORIGIN cross-origin logic in ReportsPage.tsx (unnecessary — dev runs through Quarkus Quinoa on :8080, so :5173 is never hit directly) in favor of a relative path, consistent with the rest of the frontend.

[sksingh2005]

@Mohamed-Alkafory Thanks for working on this! Few suggestions:

• PR Scope & Git History:
  - Since Non-/api requests missing auth token after Keycloak migration #201 and read-hook fixes were folded in, please update the PR title/description to document that it closes both Report export fails with 401/404 (auth token not sent) #197 and Non-/api requests missing auth token after Keycloak migration #201.
  - Please rebase/squash to remove the merge commit (4c61385).

• Remove BACKEND_ORIGIN in ReportsPage.tsx:
  - Dev runs through Quarkus Quinoa on :8080 (reverse-proxying to Vite), so :5173 is not accessed directly.
  - Hitting :8080 cross-origin from :5173 fails CORS. Use relative paths like the rest of the frontend.

• Consolidate Auth / Token Logic:
  - ReportsPage.tsx currently duplicates manual token-refresh logic instead of reusing withAuthHeader from utils/api.ts.
  - Calling withAuthHeader before window.fetch causes duplicate token refreshes for /api/* requests since AuthProvider.tsx also intercepts
  them.

• Recommendation: Extending AuthProvider.tsx's fetch interceptor to cover all same-origin paths fixes Report export fails with 401/404 (auth token not sent) #197, Non-/api requests missing auth token after Keycloak migration #201, useJson, and useText centrally without needing changes across multiple files.

[jesperpedersen]

@Mohamed-Alkafory Remember to squash

[Mohamed-Alkafory]

@jesperpedersen Thanks for the reminder — done, squashed into a single commit.

[Mohamed-Alkafory]

@sksingh2005 Thanks for the detailed review! Addressed all points:

• History squashed into a single commit — linear now, merge commit gone
• Removed BACKEND_ORIGIN, using relative paths
• Centralized auth in AuthProvider's fetch interceptor instead of per-file
  workarounds — deleted withAuthHeader entirely, api.ts/useJson/useText are
  back to plain fetch

PTAL whenever you get a chance!

[sksingh2005]

LGTM. Two non-fetch paths still bypass auth: utils/forms.ts:66 (submitBrowserForm, fallback in CompanyFormPage.tsx:277 will 403) and ticket PDF anchors in SupportTicketDetailPage.tsx:1341,1359 (plain href GETs carry no Bearer). Worth a follow-up.

[Mohamed-Alkafory]

@sksingh2005 Addressed both:

1. Removed the submitBrowserForm fallback in CompanyFormPage — it was
   firing an unauthenticated POST after the Keycloak migration removed
   cookie auth. Now surfaces a network error instead.
2. Replaced the two plain PDF export links in
   SupportTicketDetailPage with authenticated fetch + blob download,
   mirroring the existing ReportsPage.exportReport pattern.

PTAL!

[sksingh2005]

@Mohamed-Alkafory Please rebase

[Mohamed-Alkafory]

@sksingh2005 Double-checked on my end — the branch is already rebased
on latest main (git log fix/report-export-auth..origin/main is empty),
the last force-push (84870be) came after that rebase, and GitHub shows
"No conflicts with base branch" with all checks passing. Let me know if
you meant something else!

[sksingh2005]

Merged. Thanks for your contribution :)