DS1 follow-up: close the sb-token trust-bug class across all surfaces

The OAuth-only 'sb-token' localStorage key was read by profile, slip,
dashboard (recent-scans), settings, and tracker for their authenticated
fetches. Email/password users never had that key, so those fetches sent
no Authorization header and silently returned nothing.

- web/src/lib/authToken.js — currentAccessToken() reads the REAL Supabase
  session (sb-<ref>-auth-token, v2 top-level or v1 currentSession), legacy
  fallback. CommonJS so Jest can unit-test it (5 tests).
- Swept all 5 pages to the helper (scan already session-first from DS1).
- lib/api.ts (0 callers) + ParlayTray (unmounted) left as dead code.

236 suites / 2842 tests green, next build exit 0.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/unit/authToken.test.js

@@ -0,0 +1,39 @@
+// DS1 follow-up — currentAccessToken reads the REAL Supabase session, so
+// email/password users' authenticated fetches carry a token (the OAuth-only
+// 'sb-token' key left them silently unauthenticated everywhere).
+
+const { currentAccessToken } = require('../../web/src/lib/authToken');
+
+function fakeWindow(store) {
+  const keys = Object.keys(store);
+  global.window = {
+    localStorage: {
+      length: keys.length,
+      key: (i) => keys[i] ?? null,
+      getItem: (k) => (k in store ? store[k] : null),
+    },
+  };
+}
+afterEach(() => { delete global.window; });
+
+describe('currentAccessToken', () => {
+  test('reads the v2 supabase session (access_token at top level)', () => {
+    fakeWindow({ 'sb-zmdnczhtdxcddsxzttub-auth-token': JSON.stringify({ access_token: 'TOKEN_V2', refresh_token: 'r' }) });
+    expect(currentAccessToken()).toBe('TOKEN_V2');
+  });
+  test('reads the v1 shape (currentSession.access_token)', () => {
+    fakeWindow({ 'sb-abc-auth-token': JSON.stringify({ currentSession: { access_token: 'TOKEN_V1' } }) });
+    expect(currentAccessToken()).toBe('TOKEN_V1');
+  });
+  test('falls back to the legacy sb-token key', () => {
+    fakeWindow({ 'sb-token': 'LEGACY' });
+    expect(currentAccessToken()).toBe('LEGACY');
+  });
+  test('no session → null (never throws on malformed JSON)', () => {
+    fakeWindow({ 'sb-x-auth-token': 'not json{' });
+    expect(currentAccessToken()).toBeNull();
+  });
+  test('SSR (no window) → null', () => {
+    expect(currentAccessToken()).toBeNull();
+  });
+});