Closes #5330

Summary

Audit: docs/issues/audit-export-401.md (Severity: Critical).

AuditPage.tsx:110 's downloadExport reads the bearer token via the
bare safeStorageGet("librefang-api-key") accessor, which only
checks localStorage. The credential layer was migrated in #3620
to prefer sessionStorage and explicitly wipe localStorage on
save (api.ts:3341-3342). So:

1. User logs in → token stored in sessionStorage, localStorage wiped.
2. User clicks "Export audit log".
3. AuditPage reads localStorage → empty → sends
   Authorization: Bearer (one trailing space, no value) → 401.
4. ApiError surfaces to the user with no actionable hint.

Broken for every user since the storage migration in #3620.

Fix

Drop the inline safeStorageGet and route through the canonical
getStoredApiKey accessor from api.ts (the same one authHeader()
and every other token consumer goes through — it checks
sessionStorage first and falls back to localStorage for legacy
tokens).

-import { safeStorageGet } from "../lib/safeStorage";
+import { getStoredApiKey } from "../api";
@@
-  const token = safeStorageGet("librefang-api-key") || "";
+  const token = getStoredApiKey();

Audit of related call sites

Other safeStorageGet sites in pages/ were audited and are not
the same bug:

• TerminalPage.tsx (terminal.fontSize + hint keys) — different
  key, never written via sessionStorage
• ChatPage.tsx (librefang.chat.show_hand_agents) — different key

None of them target librefang-api-key, so no further changes.

A lint rule / grep gate against safeStorageGet("librefang-api-key")
in pages/ (suggested in the audit doc) is intentionally deferred —
that's a separate dashboard tooling change.

Verification

pnpm typecheck    # clean
pnpm build        # succeeded

Test plan

• Log in (token lands in sessionStorage), navigate to Audit
  page, click "Export CSV" / "Export JSON" — file downloads with
  non-empty body
• Same flow on a clone with only localStorage set (legacy
  pre-Dashboard stores bearer token in localStorage; WebSocket auth via ?token= URL query string #3620 storage state) — also succeeds, since getStoredApiKey
  falls back