Auth fix: apiPost/apiPut/apiDelete uses Bearer token

sport2.html:
- apiPost: localStorage pgz_access → Authorization: Bearer
- apiPut, apiDelete added
- Better error toast

Login redirect (multiple files):
- Wrap auto-redirect in __pgz_made_api_call check
- Don't redirect on initial page load if user has no API call yet

static/app.html

@@ -481,7 +481,7 @@ async function apiAuth(path, opts){
       const onLogin = location.pathname.includes('/login');
       if(!onLogin && !window.__pgz_redirecting){
         window.__pgz_redirecting = true;
-        window.location.href = '/login?reason=unauthorized';
+        window.(window.__pgz_made_api_call ? location.href = '/login?reason=unauthorized' : console.warn('[auth] no token but no API call yet, skipping redirect'));
       }
       return {__unauthorized:true, status:401};
     }