refacto: Cooldown is now user-set

public/src/api.js

@@ -3,7 +3,9 @@
 // parsed JSON. No state mutations, no DOM access.
 
 export async function apiFetchConfig(team) {
-  const res = await fetch(`/api/config?team=${encodeURIComponent(team)}`);
+  const token = localStorage.getItem("authToken");
+  const headers = token ? { Authorization: `Bearer ${token}` } : {};
+  const res = await fetch(`/api/config?team=${encodeURIComponent(team)}`, { headers });
   if (!res.ok) throw new Error("config_fetch_failed");
   return res.json();
 }
@@ -21,9 +23,13 @@ export async function apiFetchGrid(seed) {
 
 /** Returns the raw Response so the caller can inspect status codes (409, 410, etc.). */
 export async function apiRevealCell(seed, x, y, team) {
+  const token = localStorage.getItem("authToken");
   return fetch("/api/cell/reveal", {
     method: "POST",
-    headers: { "Content-Type": "application/json" },
+    headers: {
+      "Content-Type": "application/json",
+      ...(token ? { Authorization: `Bearer ${token}` } : {}),
+    },
     body: JSON.stringify({ seed, x, y, team }),
   });
 }