Fix 401 race condition: wire getAccessToken at module level

The auth store loads tokens from localStorage synchronously at import
time, but configureAuth() was deferred to a useEffect — so the first
API requests fired before the token getter was wired, causing 401s on
hard refresh. Now getAccessToken reads from the store by default.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

ui/src/auth/use-auth.ts

@@ -7,10 +7,9 @@ export function useAuth() {
   const { accessToken, isAuthenticated, refresh, logout } = useAuthStore();
   const navigate = useNavigate();
 
-  // Wire API client to auth store
+  // Wire onUnauthorized handler (needs navigate from router context)
   useEffect(() => {
     configureAuth({
-      getAccessToken: () => useAuthStore.getState().accessToken,
       onUnauthorized: async () => {
         const ok = await useAuthStore.getState().refresh();
         if (!ok) {