fix: use api.exportZip/Json instead of window.open

SettingsPage was still calling window.open() directly,
bypassing the auth-enabled fetch methods in api.js.

Changed buttons to use api.exportZip() and api.exportJson()
which properly include authentication headers.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

frontend/src/pages/SettingsPage.jsx

@@ -291,12 +291,12 @@ export default function SettingsPage() {
           )}
           {canExport && <>
             <button className="btn btn-primary btn-full"
-              onClick={()=>window.open('/api/export/zip')}>
+              onClick={()=>api.exportZip()}>
               <Download size={14}/> ZIP exportieren
               <span style={{fontSize:11,opacity:0.8,marginLeft:6}}>— je eine CSV pro Kategorie</span>
             </button>
             <button className="btn btn-secondary btn-full"
-              onClick={()=>window.open('/api/export/json')}>
+              onClick={()=>api.exportJson()}>
               <Download size={14}/> JSON exportieren
               <span style={{fontSize:11,opacity:0.8,marginLeft:6}}>— maschinenlesbar, alles in einer Datei</span>
             </button>