Changed from window.open() to fetch() + Blob download.
window.open() cannot send custom headers, causing 401 errors.
**Changed:**
- exportZip: fetch with auth, download blob as .zip
- exportJson: fetch with auth, download blob as .json
- exportCsv: fetch with auth, download blob as .csv
All exports now work with authenticated sessions.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Frontend was sending {email, pin} but backend expects {email, password}.
This caused 422 Unprocessable Entity errors.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
