fix: wire auth PIN to frontend — 401 on NAM select and all POST/PUT calls

Root cause: auth middleware (1603bfe) blocked all non-GET /api/ endpoints
requiring X-Pedal-Auth header, but the PIN was never served to the frontend.

Fix:
- Added auth_pin to /api/state response (safe GET endpoint, no auth required)
- Frontend stores pin from state on initial load
- apiPost/apiPut/apiDelete/apiUpload now include X-Pedal-Auth header

src/web/server.py

@@ -2910,6 +2910,7 @@ iface eth0 inet static
             "bluetooth": self._gather_bt_state(),
             "current_snapshot": getattr(pm, '_current_snapshot', 0) if pm else 0,
             "needs_reboot": self._needs_reboot,
+            "auth_pin": self._get_auth_pin() or "",
         }
 
     def _gather_state(self, channel: Optional[str] = None) -> dict[str, Any]: