fix(axios): gate anonymous-id header on request-time Authorization

[cowchimp]

To fix issue from #198

src/utils/axios-client.ts:181 — the !token guard checks construction-time state, not live auth, so authenticated browser users send the anon header anyway.
The interceptor closes over token from createAxiosClient(...). The dominant browser auth path does not pass token to the constructor — client.ts:158-163 calls userAuthModule.setToken(getAccessToken()), which sets axios.defaults.headers.common["Authorization"] after the client is built. The closure token stays undefined, so every request from a logged-in user now carries both Authorization: Bearer … and X-Base44-Anonymous-Id. This is the exact opposite of the stated invariant ("authenticated clients … no anon header"). The unit test only exercises the constructor-token path, so it passes while the common path is broken. A request-time check (e.g. !config.headers.get("Authorization")) would reflect actual auth state. Note the socket path (config.token ?? getAccessToken()) already resolves the live token correctly — the two paths are inconsistent.

[claude]

Claude encountered an error —— View job

---

I'll analyze this and get back to you.

[github-actions]

🚀 Package Preview Available!

---

Install this PR's preview build with npm:

npm i @base44-preview/sdk@0.8.33-pr.207.0a378fa

Prefer not to change any import paths? Install using npm alias so your code still imports @base44/sdk:

npm i "@base44/sdk@npm:@base44-preview/sdk@0.8.33-pr.207.0a378fa"

Or add it to your package.json dependencies:

{
  "dependencies": {
    "@base44/sdk": "npm:@base44-preview/sdk@0.8.33-pr.207.0a378fa"
  }
}

• 📦 Preview Package: @base44-preview/sdk@0.8.33-pr.207.0a378fa
• 🔗 View this commit on GitHub

---

_{Preview published to npm registry — try new features instantly!}