fix: konvertera alla API route handlers till withAuth wrapper

Ersätter getAuthHeaders() + auth() standalone med withAuth() wrapper
i alla route handlers. Auth() standalone fungerar inte korrekt i
Next.js 16 + NextAuth beta.28 pga async cookies() kompatibilitet.
withAuth() använder auth() i wrapper-form sa att request.auth
populeras direkt av NextAuth.

Pavaerkade filer: 27 route handlers + ny lib/with-auth.ts

frontend/app/api/products/route.ts

@@ -1,5 +1,5 @@
 import { NextRequest, NextResponse } from 'next/server';
-import { getAuthHeaders } from '../../../lib/auth-headers';
+import { withAuth } from '../../../lib/with-auth';
 
 const API_BASE = process.env.NEXT_PUBLIC_API_URL_INTERNAL || 'http://recipe-api:8080';
 
@@ -15,17 +15,13 @@ export async function GET(req: NextRequest) {
   return NextResponse.json(data, { status: res.status });
 }
 
-export async function POST(req: NextRequest) {
+export const POST = withAuth(async (req, session) => {
   const body = await req.json();
-  const authHeaders = await getAuthHeaders();
-  // Debug: log auth headers
-  // eslint-disable-next-line no-console
-  console.log('API /api/products POST: authHeaders =', authHeaders);
   const res = await fetch(`${API_BASE}/api/products`, {
     method: 'POST',
-    headers: { 'Content-Type': 'application/json', ...authHeaders },
+    headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${session.accessToken}` },
     body: JSON.stringify(body),
   });
   const data = await res.json();
   return NextResponse.json(data, { status: res.status });
-}
+});