v3: fixed authorization bug with stale tokens, fixed private dump access bug, various small fixes across the app

src/hooks/useAuth.ts

@@ -41,7 +41,9 @@ export const useAuth = () => {
       ...init,
       headers: {
         ...(init.headers ?? {}),
-        Authorization: `Bearer ${token}`,
+        // Only attach a token when we actually have one — avoids sending a
+        // `Bearer undefined` header that the server would reject as invalid.
+        ...(token ? { Authorization: `Bearer ${token}` } : {}),
         // Let the browser set Content-Type for FormData (it includes the boundary)
         ...(isFormData ? {} : { "Content-Type": "application/json" }),
       },