fix: use authenticated API for remote config polling (#8266)

## Summary
- Fixes remote config polling to use authenticated API
- Consolidates `loadRemoteConfig` into `refreshRemoteConfig` with auth
control
- Adds unit tests for both auth modes

## Problem
The cloud extension's polling interval was using unauthenticated
`fetch`, causing it to receive only default feature flags instead of
user-specific configurations.

**Root cause:**
1. Bootstrap called `loadRemoteConfig()` (raw `fetch`, no auth) -
correct, auth not initialized yet
2. Extension watch called `refreshRemoteConfig()` (`api.fetchApi`, with
auth) - correct
3. Extension interval called `loadRemoteConfig()` (raw `fetch`, no auth)
- **bug**

## Solution
- Consolidate into single `refreshRemoteConfig()` with optional
`useAuth` parameter (defaults to `true`)
- Bootstrap: `refreshRemoteConfig({ useAuth: false })`
- Polling: `refreshRemoteConfig()` (authenticated by default)

## Test Plan
- Unit tests verify both auth modes
- `pnpm typecheck`, `pnpm lint`, `pnpm test:unit` all pass

┆Issue is synchronized with this [Notion
page](https://www.notion.so/PR-8266-fix-use-authenticated-API-for-remote-config-polling-2f16d73d3650817ea7b0e3a7e3ccf12a)
by [Unito](https://www.unito.io)

src/platform/remoteConfig/refreshRemoteConfig.ts

@@ -2,9 +2,28 @@ import { api } from '@/scripts/api'
 
 import { remoteConfig } from './remoteConfig'
 
-export async function refreshRemoteConfig(): Promise<void> {
+interface RefreshRemoteConfigOptions {
+  /**
+   * Whether to use authenticated API (default: true).
+   * Set to false during bootstrap before auth is initialized.
+   */
+  useAuth?: boolean
+}
+
+/**
+ * Loads remote configuration from the backend /features endpoint
+ * and updates the reactive remoteConfig ref
+ */
+export async function refreshRemoteConfig(
+  options: RefreshRemoteConfigOptions = {}
+): Promise<void> {
+  const { useAuth = true } = options
+
   try {
-    const response = await api.fetchApi('/features', { cache: 'no-store' })
+    const response = useAuth
+      ? await api.fetchApi('/features', { cache: 'no-store' })
+      : await fetch('/api/features', { cache: 'no-store' })
+
     if (response.ok) {
       const config = await response.json()
       window.__CONFIG__ = config
@@ -19,5 +38,7 @@ export async function refreshRemoteConfig(): Promise<void> {
     }
   } catch (error) {
     console.error('Failed to fetch remote config:', error)
+    window.__CONFIG__ = {}
+    remoteConfig.value = {}
   }
 }