fix: send X-Requested-With header to pass backend CSRF check

Author: d-e-v-14

src/api/axios.ts

@@ -5,6 +5,7 @@ export const API_BASE_URL = process.env.NEXT_PUBLIC_API_URL;
 export const api = axios.create({
   baseURL: API_BASE_URL,
   withCredentials: true,
+  headers: { "X-Requested-With": "XMLHttpRequest" },
 });
 
 export const apiClient = api;

src/lib/auth/tokenStore.ts

@@ -95,7 +95,10 @@ export const tokenStore = {
       const response = await fetch(`${API_URL}/api/auth/refresh`, {
         method: "POST",
         credentials: "include",
-        headers: { "Content-Type": "application/json" },
+        headers: {
+          "Content-Type": "application/json",
+          "X-Requested-With": "XMLHttpRequest",
+        },
         body: JSON.stringify(token ? { refreshToken: token } : {}),
       });