add school year and security fix

src/api/http.ts

@@ -1,4 +1,5 @@
 import { apiUrl } from '../lib/apiOrigin'
+import { selectedSchoolYearHeaders } from '../lib/schoolYearSelection'
 
 const TOKEN_KEY = 'alrahma_api_token'
 
@@ -30,6 +31,14 @@ export function decodeJwtPayload<T = unknown>(token: string): T | null {
   }
 }
 
+
+export function applyStoredSchoolYearHeaders(headers: Headers): Headers {
+  for (const [key, value] of Object.entries(selectedSchoolYearHeaders())) {
+    if (!headers.has(key)) headers.set(key, value)
+  }
+  return headers
+}
+
 export class ApiHttpError extends Error {
   readonly status: number
   readonly body: unknown
@@ -60,6 +69,10 @@ export async function apiFetch<T>(
     headers.set('Authorization', `Bearer ${token}`)
   }
 
+  if (attachAuth && token) {
+    applyStoredSchoolYearHeaders(headers)
+  }
+
   const url = apiUrl(path)
 
   let res: Response