Fix Content-Type header silently dropped on every authenticated request

req()'s fetch init merged headers as { headers: {Content-Type, ...opts.headers}, ...opts }
— spreading ...opts LAST meant opts.headers (e.g. just Authorization) fully
overwrote the merged headers object, silently dropping Content-Type:
application/json from every call that also passed custom headers (i.e.
every authenticated request: addCredential, deleteCredential, createApiKey,
revokeApiKey, regenKey, all adminApi mutations).

Confirmed via direct reproduction against production: without Content-Type,
the request body arrived at the backend re-wrapped as a JSON string instead
of parsed as an object, producing "Input should be a valid dictionary or
object to extract fields from" on every POST/PATCH/DELETE with a body.
Reordered the spread so headers merge correctly.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/lib/api.ts

@@ -25,8 +25,8 @@ function errorDetailToMessage(detail: unknown): string {
 
 async function req<T>(path: string, opts?: RequestInit): Promise<T> {
   const res = await fetch(`${BASE}${path}`, {
-    headers: { 'Content-Type': 'application/json', ...opts?.headers },
     ...opts,
+    headers: { 'Content-Type': 'application/json', ...opts?.headers },
   });
   let data: unknown;
   try {