fix: Content-Type header dropped when authenticated, causing 422 on job submit

The spread { ...defaults, ...opts } overwrote the merged headers with
opts.headers (which only had Authorization). Now headers are built once
and passed as the final value.

Generated with [Claude Code](https://claude.ai/code)
via [Happy](https://happy.engineering)

Co-Authored-By: Claude <noreply@anthropic.com>
Co-Authored-By: Happy <yesreply@happy.engineering>

frontend/js/api.js

@@ -12,17 +12,12 @@ const BASE = '';  // same-origin; empty string = relative to current host
  * @returns {Promise<any>}
  */
 async function apiFetch(path, opts = {}) {
+  const headers = { 'Content-Type': 'application/json', ...(opts.headers || {}) };
   const session = JSON.parse(sessionStorage.getItem('aperture_session') || 'null');
   if (session) {
-    opts.headers = {
-      ...opts.headers,
-      'Authorization': `Bearer ${session.email}:${session.token}`,
-    };
+    headers['Authorization'] = `Bearer ${session.email}:${session.token}`;
   }
-  const defaults = {
-    headers: { 'Content-Type': 'application/json', ...(opts.headers || {}) },
-  };
-  const res = await fetch(BASE + path, { ...defaults, ...opts });
+  const res = await fetch(BASE + path, { ...opts, headers });
   if (!res.ok) {
     let detail = res.statusText;
     try {