fix: unify fetch calls to use authedFetch for protected routes

[itsmiso-ai]

Fixes #319

Replace plain fetch() with authedFetch() in all client-side API calls to protected mutating and data routes. This ensures DISPATCH_AUTH_MODE=basic operators get consistent Basic Auth header injection.

Files changed:

• src/app/automation/activity/page.tsx: events list fetch
• src/app/automation/workflows/[id]/page.tsx: workflow detail, dispatch, rerun
• src/app/agents/agent-work-panel.tsx: agent work panel CRUD operations

Left unchanged: login page session check (pre-auth, not a protected route)

[its-saffron]

AI Automated Review

Full PR review.

Analysis engine: review@https://litellm.jory.dev/v1 (openai)

Recommendation

Approved. This PR correctly addresses the technical debt identified in issue PR 319 by replacing plain fetch() calls with authedFetch() in client-side components that interact with protected API routes. This ensures consistent authentication (specifically Basic Auth) for operators when DISPATCH_AUTH_MODE=basic is configured.

Change-by-Change Findings

• src/app/agents/agent-work-panel.tsx: Replaced fetch with authedFetch for retrieving agent work and for mutating actions (release, reassign).
• src/app/automation/activity/page.tsx: Replaced fetch with authedFetch for retrieving the activity feed.
• src/app/automation/workflows/[id]/page.tsx: Replaced fetch with authedFetch for fetching workflow details and for dispatching/rerunning workflow runs.

Standards Compliance

• Code Standards: The changes follow the repository's pattern of using authedFetch for protected routes as documented in README.md and AGENTS.md.
• Security: By using authedFetch, the implementation ensures that mutating requests (POST) and sensitive data reads are properly authenticated, preventing 401 errors for operators using Basic Auth.

Linked Issue Fit

• Issue PR 319: The PR directly implements the recommendation from the audit finding: "Other active UI paths still use plain fetch() for protected mutating routes, which means DISPATCH_AUTH_MODE=basic operators can hit 401s". The implementation covers the specific files identified in the audit evidence.