fix: address final review findings

- Finding 1: add AppState::authed_get/authed_post helpers that attach
  Bearer token when present; all 4 commands now use them
- Finding 2: MessageInput accepts onSent callback, calls it after
  successful send; ChatPage passes refreshKey bump as onSent
- Finding 3: MessageList useEffect uses cancellation flag so stale
  in-flight responses cannot overwrite a newly selected conversation
- Finding 4: scrollIntoView moved to separate effect keyed on
  messages.length so scroll only fires when new messages arrive

src-tauri/src/commands/message.rs

@@ -7,8 +7,7 @@ pub async fn list_messages(
     conversation_id: String,
 ) -> Result<Vec<Message>, String> {
     state
-        .client
-        .get(format!("{}/conversations/{}/messages", BASE_URL, conversation_id))
+        .authed_get(&format!("{}/conversations/{}/messages", BASE_URL, conversation_id))
         .send()
         .await
         .map_err(|e| e.to_string())?
@@ -37,8 +36,7 @@ pub async fn send_message(
     });
 
     state
-        .client
-        .post(format!("{}/messages", BASE_URL))
+        .authed_post(&format!("{}/messages", BASE_URL))
         .json(&body)
         .send()
         .await