// ── API helpers ───────────────────────────────────────────────────
async function apiGet(path) {
  try {
    const r = await fetch(path, { headers:{'Authorization':`Bearer ${authToken}`} });
    if (r.status===401) { doLogout(); return null; }
    return r.json();
  } catch { return null; }
}
async function apiPost(path, body, method='POST') {
  try {
    const r = await fetch(path, {
      method,
      headers:{'Authorization':`Bearer ${authToken}`,'Content-Type':'application/json'},
      body:JSON.stringify(body)
    });
    if (r.status===401) { doLogout(); return null; }
    return r.json();
  } catch { return null; }
}
async function apiDelete(path) {
  try {
    const r = await fetch(path, { method:'DELETE', headers:{'Authorization':`Bearer ${authToken}`} });
    if (r.status===401) { doLogout(); return null; }
    return r.json();
  } catch { return null; }
}