[Extension] Route all freighter-backend-v2 calls through the authed fetch wrapper

[piyalbasu]

Centralize the scattered INDEXER_V2_URL fetches through a single backend-v2 client built on authedFetch (#2770), so every request to freighter-backend-v2 carries a per-request JWT when the user is authenticated.

Today each call site builds its own fetch/URL against INDEXER_V2_URL:

• @shared/api/internal.ts (e.g. /protocols)
• @shared/api/helpers/fetchCollectibles.ts (/collectibles)
• @shared/api/helpers/getLedgerKeyAccounts.ts (/ledger-key/accounts)
• extension/src/background/helpers/account.ts (/rpc-health)
• (plus any others reaching INDEXER_V2_URL)

Route them all through one wrapper that:

• attaches the per-request JWT (buildAuthJwt / authedFetch, [Extension] Generate per-request backend JWT in @shared/api #2770) when the background has an unlocked auth keypair ([Extension] Derive auth keypair from seed for backend authentication #2769);
• sends anonymously when no seed is unlocked (the backend stays permissive — see freighter-backend-v2 companion ticket);
• retries once on 401 (already in authedFetch).

Part of the Unified User Model auth rollout: "whenever Freighter clients call freighter-backend-v2, they go through a wrapped fetch that derives the auth key and sends the JWT."

Depends on: #2769, #2770.

Acceptance:

• All backend-v2 requests flow through the shared wrapper; no call site constructs its own fetch to INDEXER_V2_URL.
• Authenticated requests (unlocked wallet) carry a valid JWT; locked / onboarding / watch-only requests still succeed anonymously.
• No regression in existing endpoint behavior.