Fix frontend WebAPI auth always failing in ApiAuthenticationService

[Copilot]

IsApiFrontAuthenticated() always returned false because it checked for [Authorize(AuthenticationSchemes = "FrontAuthentication")] on the endpoint metadata — but no web store endpoints carry that attribute.

Changes

• ApiAuthenticationService.IsApiFrontAuthenticated(): Replace the endpoint metadata inspection with an actual AuthenticateAsync(FrontendAPIConfig.AuthenticationScheme) call. If the JWT was signed with the frontend secret key, the scheme handler validates it and returns success.
• Method signature changed from bool to async Task<bool>; call site updated to await.
• Removed now-unused Microsoft.AspNetCore.Authorization import.

// Before — always false; no endpoints have [Authorize(AuthenticationSchemes = "FrontAuthentication")]
private bool IsApiFrontAuthenticated()
{
    var endpoint = _httpContextAccessor.HttpContext.GetEndpoint();
    if (endpoint == null) return false;
    var authorizeAttributes = endpoint.Metadata.GetOrderedMetadata<AuthorizeAttribute>();
    return authorizeAttributes.Any(attr => attr.AuthenticationSchemes?.Contains(FrontendAPIConfig.AuthenticationScheme) == true);
}

// After — succeeds when the bearer token is a valid FrontendAPI JWT
private async Task<bool> IsApiFrontAuthenticated()
{
    var authResult = await _httpContextAccessor.HttpContext.AuthenticateAsync(FrontendAPIConfig.AuthenticationScheme);
    return authResult.Succeeded;
}

ASP.NET Core caches auth results per request, so the subsequent AuthenticateAsync call inside ApiCustomer() incurs no extra overhead.