Set the auth header for the merits API inside useApiFetch

[tom2drum]

Description and Related Issue(s)

Resolves #2978

This PR refactors the authentication header handling for the rewards API by centralizing it in the useApiFetch hook. Previously, the authorization header was manually passed in each API call throughout the codebase. Now, the hook automatically adds the Bearer token header when making requests to the rewards API, simplifying the code and reducing duplication.

Proposed Changes

• Centralized auth header in useApiFetch: The hook now automatically adds the Authorization: Bearer <token> header for all rewards API requests by reading the token from cookies
• Refactored rewards context: Replaced apiToken state with isAuth boolean flag for clearer authentication state management
• Removed manual header passing: Eliminated redundant Authorization header definitions from individual API calls across multiple components and hooks
• Improved logout flow: Integrated rewards logout into the main logout hook for better consistency

The changes affect the following files:

• lib/api/useApiFetch.tsx - Added automatic auth header injection for rewards API
• lib/contexts/rewards.tsx - Refactored to use isAuth instead of apiToken
• Multiple components and hooks updated to use the new isAuth flag and remove manual headers

Breaking or Incompatible Changes

None. This is a refactoring that maintains the same functionality while improving code organization.

Additional Information

This refactoring improves maintainability by:

• Reducing code duplication across multiple files
• Centralizing authentication logic in a single location
• Making it easier to modify auth behavior in the future
• Simplifying the component code by removing manual header management

Checklist for PR author

• I have tested these changes locally.
• I added tests to cover any new functionality, following this guide
• Whenever I fix a bug, I include a regression test to ensure that the bug does not reappear silently.
• If I have added a feature or functionality that is not privacy-compliant (e.g., tracking, analytics, third-party services), I have disabled it for private mode.
• If I have added, changed, renamed, or removed an environment variable
  • I updated the list of environment variables in the documentation
  • I made the necessary changes to the validator script according to the guide
  • I added "ENVs" label to this pull request