fix: use SDK.fetchJSON to include session token in API calls

[CountZer0]

Problem

Since Hermes Agent v2026.5.16 (PR NousResearch/hermes-agent#23220, commit ec9329e), the dashboard auth middleware in web_server.py no longer exempts /api/plugins/* routes from session-token authentication. All plugin API calls now require the X-Hermes-Session-Token header.

Canvas uses its own bare apiJSON() function with raw fetch() — no session token is sent. This causes 401 UNAUTHORIZED on every API call (status, project create, dev start, agent prompts, etc.).

Root Cause

dashboard/dist/index.js lines 47–75: custom apiJSON/postJSON/getJSON utilities use fetch() directly instead of SDK.fetchJSON, which automatically injects the X-Hermes-Session-Token header.

The Kanban plugin and other bundled plugins already use SDK.fetchJSON — Canvas was the outlier.

Fix

Replaced the apiJSON/postJSON/getJSON trio with calls to SDK.fetchJSON. This is a 1:1 swap — SDK.fetchJSON returns a Promise that resolves to parsed JSON, same as the old apiJSON.

• Removes 15 lines of custom fetch wrapper
• postJSON and getJSON now delegate to SDK.fetchJSON
• No behavior change other than including the session token

Testing

• Restart the Hermes dashboard (hermes dashboard --no-open)
• Hard refresh browser (Cmd+Shift+R)
• Open the Canvas tab — status, project create, and dev server controls should work without 401 errors

Closes #1