fix: send auth token with sentence boundary API requests

ios/OralTrainer/Services/HTTPClient.swift

@@ -25,14 +25,17 @@ enum HTTPClient {
         _ type: T.Type,
         baseURL: String,
         path: String,
-        timeout: TimeInterval
+        timeout: TimeInterval,
+        additionalHeaders: [String: String] = [:]
     ) async throws -> (value: T, effectiveBaseURL: String) {
+        var headers = ["Accept": "application/json"]
+        headers.merge(additionalHeaders) { _, new in new }
         let result = try await execute(
             baseURL: baseURL,
             path: path,
             method: "GET",
             timeout: timeout,
-            headers: ["Accept": "application/json"]
+            headers: headers
         )
         guard (200...299).contains(result.statusCode) else {
             let body = String(data: result.body, encoding: .utf8) ?? ""

ios/OralTrainer/Services/SentenceBoundaryAPI.swift

@@ -20,11 +20,16 @@ enum SentenceBoundaryAPI {
         guard hash.range(of: AppConfig.sha256Pattern, options: .regularExpression) != nil else {
             throw SentenceBoundaryAPIError.invalidHash
         }
+        var headers: [String: String] = [:]
+        if !AppConfig.authToken.isEmpty {
+            headers["Authorization"] = "Bearer \(AppConfig.authToken)"
+        }
         let result = try await HTTPClient.getJSON(
             SentenceBoundaryDocument.self,
             baseURL: AppConfig.serverBaseURL,
             path: "api/v1/videos/\(hash)/sentence-boundaries",
-            timeout: AppConfig.readTimeout
+            timeout: AppConfig.readTimeout,
+            additionalHeaders: headers
         )
         guard result.value.videoHash.lowercased() == hash else {
             throw SentenceBoundaryAPIError.hashMismatch