add school year and security fix

src/api/printables.ts

@@ -2,7 +2,7 @@
  * Stickers, badges, report cards (legacy CI printables_reports/*).
  */
 import { apiUrl } from '../lib/apiOrigin'
-import { ApiHttpError, apiFetch, getStoredToken } from './http'
+import { ApiHttpError, apiFetch, applyStoredSchoolYearHeaders, getStoredToken } from './http'
 
 export type ClassOption = { class_section_id?: number; id?: number; class_section_name?: string }
 
@@ -40,6 +40,7 @@ export async function postStickerGenerate(formData: FormData): Promise<Blob> {
   const headers = new Headers({ Accept: 'application/pdf,*/*' })
   const token = getStoredToken()
   if (token) headers.set('Authorization', `Bearer ${token}`)
+  applyStoredSchoolYearHeaders(headers)
   const res = await fetch(apiUrl('/api/v1/administrator/printables/stickers/generate'), {
     method: 'POST',
     headers,
@@ -61,6 +62,7 @@ export async function postBadgeGenerate(formData: FormData): Promise<Blob> {
   const headers = new Headers({ Accept: 'application/pdf,*/*' })
   const token = getStoredToken()
   if (token) headers.set('Authorization', `Bearer ${token}`)
+  applyStoredSchoolYearHeaders(headers)
   const res = await fetch(apiUrl('/api/v1/badges/pdf'), {
     method: 'POST',
     headers,
@@ -242,6 +244,7 @@ export async function fetchReportCardStudentHtml(
   const headers = new Headers({ Accept: 'text/html' })
   const token = getStoredToken()
   if (token) headers.set('Authorization', `Bearer ${token}`)
+  applyStoredSchoolYearHeaders(headers)
   const path = `/api/v1/reports/report-cards/students/${encodeURIComponent(String(studentId))}?${qs}`
   const res = await fetch(apiUrl(path), { headers })
   if (!res.ok) throw new ApiHttpError(`HTTP ${res.status}`, res.status, null)
@@ -260,6 +263,7 @@ export async function fetchReportCardClassHtml(
   const headers = new Headers({ Accept: 'text/html' })
   const token = getStoredToken()
   if (token) headers.set('Authorization', `Bearer ${token}`)
+  applyStoredSchoolYearHeaders(headers)
   const path = `/api/v1/reports/report-cards/classes/${encodeURIComponent(String(classSectionId))}?${qs}`
   const res = await fetch(apiUrl(path), { headers })
   if (!res.ok) throw new ApiHttpError(`HTTP ${res.status}`, res.status, null)
@@ -271,6 +275,7 @@ export async function openReportCardDownload(url: string): Promise<void> {
   const headers = new Headers({ Accept: 'application/pdf,*/*' })
   const token = getStoredToken()
   if (token) headers.set('Authorization', `Bearer ${token}`)
+  applyStoredSchoolYearHeaders(headers)
   const res = await fetch(url, { headers })
   if (!res.ok) throw new ApiHttpError(`HTTP ${res.status}`, res.status, null)
   const raw = await res.blob()