fix: ensure all API requests use user ID and fix missing data migration for existing users

packages/ui/src/lib/user-context.ts

@@ -45,22 +45,55 @@ export function getUserHeaders(): Record<string, string> {
  */
 export function withUserHeaders(options: RequestInit = {}): RequestInit {
     const userHeaders = getUserHeaders()
+    if (Object.keys(userHeaders).length === 0) return options
+
+    const headers = new Headers(options.headers || {})
+    for (const [key, value] of Object.entries(userHeaders)) {
+        headers.set(key, value)
+    }
+
     return {
         ...options,
-        headers: {
-            ...options.headers,
-            ...userHeaders,
-        },
+        headers,
     }
 }
 
 /**
  * Fetch wrapper that automatically includes user headers
  */
-export async function userFetch(url: string, options: RequestInit = {}): Promise<Response> {
+export async function userFetch(url: string | URL | Request, options: RequestInit = {}): Promise<Response> {
     return fetch(url, withUserHeaders(options))
 }
 
+/**
+ * Globally patch fetch to include user headers for all internal /api/* requests
+ * This ensures compatibility with legacy code and 3rd party libraries.
+ */
+export function patchFetch(): void {
+    if ((window as any)._codenomad_fetch_patched) return
+    (window as any)._codenomad_fetch_patched = true
+
+    const originalFetch = window.fetch
+    window.fetch = async function (input: RequestInfo | URL, init?: RequestInit) {
+        let url = ""
+        if (typeof input === "string") {
+            url = input
+        } else if (input instanceof URL) {
+            url = input.toString()
+        } else if (input instanceof Request) {
+            url = input.url
+        }
+
+        // Only inject headers for internal API calls
+        if (url.startsWith("/api/") || url.includes(window.location.origin + "/api/")) {
+            return originalFetch(input, withUserHeaders(init))
+        }
+
+        return originalFetch(input, init)
+    }
+    console.log("[UserContext] Global fetch patched for /api/* requests")
+}
+
 /**
  * Initialize user context from Electron IPC
  * Call this on app startup