Harden user management integration

src/frontend/utils/auth-api.ts

@@ -1,3 +1,8 @@
+import {
+  WRITE_REQUEST_HEADER_NAME,
+  WRITE_REQUEST_HEADER_VALUE,
+} from "../../shared/constants/request-security";
+
 // Small, self-contained fetch helper for the auth/user endpoints - kept
 // separate from the large domain api.ts so this feature doesn't have to
 // touch that file's shared `request()` internals.
@@ -39,7 +44,11 @@ export class AuthApiError extends Error {
 async function request<T>(url: string, init?: RequestInit): Promise<T> {
   const response = await fetch(url, {
     ...init,
-    headers: { "Content-Type": "application/json", ...init?.headers },
+    headers: {
+      "Content-Type": "application/json",
+      [WRITE_REQUEST_HEADER_NAME]: WRITE_REQUEST_HEADER_VALUE,
+      ...init?.headers,
+    },
     cache: "no-store",
   });
   if (!response.ok) {