fix: ensure auth token is present before upload request

Add proactive token refresh when getAccessToken() returns null, plus
401 retry logic. The in-memory token can be null if it expired between
page load and upload attempt.

Co-Authored-By: Claude <noreply@anthropic.com>

src/api/common.ts

@@ -53,16 +53,35 @@ export const commonApi = {
     formData.append('bucket', bucket);
     formData.append('path_prefix', pathPrefix);
 
-    const token = getAccessToken();
+    if (!getAccessToken()) {
-    const headers: Record<string, string> = {};
+      const { authApi } = await import('./auth');
-    if (token) headers['Authorization'] = `Bearer ${token}`;
+      try { await authApi.refresh(); } catch { /* will fail on upload */ }
+    }
 
-    const res = await fetch('/api/v1/common/upload', {
+    const doUpload = async () => {
-      method: 'POST',
+      const token = getAccessToken();
-      headers,
+      const headers: Record<string, string> = {};
-      body: formData,
+      if (token) headers['Authorization'] = `Bearer ${token}`;
-      credentials: 'include',
+
-    });
+      return fetch('/api/v1/common/upload', {
+        method: 'POST',
+        headers,
+        body: formData,
+        credentials: 'include',
+      });
+    };
+
+    let res = await doUpload();
+
+    if (res.status === 401) {
+      const { authApi } = await import('./auth');
+      try {
+        await authApi.refresh();
+      } catch {
+        throw new Error('auth expired');
+      }
+      res = await doUpload();
+    }
 
     if (!res.ok) {
       throw new Error('upload failed');