feature-flags.ts and prompt-client.ts used bare 'access_token' key
instead of PRODUCT_ID-prefixed key — auth tokens were never sent.
Consolidates 10 web lib files to import the shared getAccessToken()
from api-helpers.ts instead of each redefining their own copy.