fix: add authorization header to InquiryBrowserClient requests

Blazor Server components cannot access client-side localStorage, so
InquiryBrowserClient needs to get the access token from server-side
ITokenStore and manually add the Authorization header to requests.

This fixes 401 Unauthorized errors when InquiryList loads inquiry data.

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

TaxBaik.Web/Services/InquiryBrowserClient.cs

@@ -1,5 +1,6 @@
 namespace TaxBaik.Web.Services;
 
+using System.Net.Http;
 using System.Net.Http.Json;
 using TaxBaik.Domain.Entities;
 
@@ -21,11 +22,21 @@ public class InquiryBrowserClient : IInquiryBrowserClient
 {
     private readonly HttpClient _http;
     private readonly ILogger<InquiryBrowserClient> _logger;
+    private readonly ITokenStore _tokenStore;
 
-    public InquiryBrowserClient(HttpClient http, ILogger<InquiryBrowserClient> logger)
+    public InquiryBrowserClient(HttpClient http, ILogger<InquiryBrowserClient> logger, ITokenStore tokenStore)
     {
         _http = http;
         _logger = logger;
+        _tokenStore = tokenStore;
+    }
+
+    private void EnsureAuthHeader()
+    {
+        if (!string.IsNullOrEmpty(_tokenStore.AccessToken) && !_http.DefaultRequestHeaders.Contains("Authorization"))
+        {
+            _http.DefaultRequestHeaders.Authorization = new("Bearer", _tokenStore.AccessToken);
+        }
     }
 
     public async Task<(IEnumerable<Inquiry> Items, int Total)> GetPagedAsync(
@@ -33,6 +44,7 @@ public class InquiryBrowserClient : IInquiryBrowserClient
     {
         try
         {
+            EnsureAuthHeader();
             var result = await _http.GetFromJsonAsync<InquiryPagedResponse>(
                 $"inquiry?page={page}&pageSize={pageSize}",
                 cancellationToken: ct);
@@ -52,6 +64,7 @@ public class InquiryBrowserClient : IInquiryBrowserClient
     {
         try
         {
+            EnsureAuthHeader();
             return await _http.GetFromJsonAsync<Inquiry>(
                 $"inquiry/{id}",
                 cancellationToken: ct);
@@ -67,6 +80,7 @@ public class InquiryBrowserClient : IInquiryBrowserClient
     {
         try
         {
+            EnsureAuthHeader();
             var request = new { status };
             var response = await _http.PutAsJsonAsync(
                 $"inquiry/{id}/status",
@@ -86,6 +100,7 @@ public class InquiryBrowserClient : IInquiryBrowserClient
     {
         try
         {
+            EnsureAuthHeader();
             var request = new { adminMemo };
             var response = await _http.PutAsJsonAsync(
                 $"inquiry/{id}/memo",
@@ -105,6 +120,7 @@ public class InquiryBrowserClient : IInquiryBrowserClient
     {
         try
         {
+            EnsureAuthHeader();
             var response = await _http.PostAsJsonAsync(
                 $"inquiry/{id}/convert-to-client",
                 new { name, phone, serviceType },