The handleFetch hook previously skipped auth headers for all URLs containing /api/users/me. Since the hook's own user-load call uses globalThis.fetch (bypassing handleFetch), it is safe to remove this exception — enabling profile update and password change actions to authenticate properly. Also regenerates API types with new profile endpoints and AppUser fields. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>