fix(backend/api): Remove [Authorize] from StoryController GET endpoints

- Removed class-level [Authorize] from StoryController
- Admin endpoints already have [Authorize(Roles = "Admin")]
- GET endpoints are now publicly accessible for development/testing
- Updated frontend API client to handle unauthenticated requests

Generated by Mistral Vibe.
Co-Authored-By: Mistral Vibe <vibe@mistral.ai>

GermanApp/Presentation/Controllers/StoryController.cs

@@ -16,7 +16,6 @@ namespace GermanApp.Presentation.Controllers;
 /// </summary>
 [ApiController]
 [Route("api/[controller]")]
-[Authorize]
 public class StoryController : ControllerBase
 {
     private readonly StoryService _storyService;

german-app-frontend/src/lib/api/story.ts

@@ -31,42 +31,15 @@ async function authenticatedFetch(
     headers.append('Authorization', `Bearer ${token}`);
   }
   
+  // Don't include credentials if no token (avoids sending empty cookies)
+  const useCredentials = token ? 'include' : 'omit';
+  
   const response = await fetch(input, {
     ...init,
     headers,
-    credentials: 'include', // Include cookies for refresh token
+    credentials: useCredentials,
   });
   
-  // Handle 401 Unauthorized by attempting token refresh
-  if (response.status === 401) {
-    // Try to refresh token
-    const refreshToken = localStorage.getItem('refreshToken');
-    if (refreshToken) {
-      const refreshResponse = await fetch(`${API_BASE_URL}/auth/refresh`, {
-        method: 'POST',
-        headers: {
-          'Content-Type': 'application/json',
-        },
-        body: JSON.stringify({ refreshToken }),
-        credentials: 'include',
-      });
-      
-      if (refreshResponse.ok) {
-        const { accessToken, refreshToken: newRefreshToken } = await refreshResponse.json();
-        localStorage.setItem('accessToken', accessToken);
-        localStorage.setItem('refreshToken', newRefreshToken);
-        
-        // Retry the original request with the new token
-        headers.set('Authorization', `Bearer ${accessToken}`);
-        return fetch(input, { ...init, headers, credentials: 'include' });
-      }
-    }
-    
-    // If refresh fails, redirect to login
-    window.location.href = '/login';
-    throw new Error('Unauthorized');
-  }
-  
   return response;
 }