fix(frontend): stabilize cash-flow forecast loading

[woahwhattheheck]

Closes #542

Summary

• Avoid mount-time empty-parameter fetch/toast behavior by leaving forecast loading to the explicit Refresh path.
• Read the canonical payd_auth_token key and omit the Authorization header when no token is present.
• Keep valid stored tokens in Bearer authorization for cash-flow API calls.
• Stabilize forecast callback dependencies on primitive account/issuer/days values plus notification functions rather than a mutable params object.

Validation

The exact two-file carrier was read back against sponsor base with zero accessToken reads in cashFlowForecastApi.ts, no parameter-driven useEffect in CashFlowForecast.tsx, and the primitive callback dependency list present. The source environment could not materialize the repository for a local build, so no build or CI pass is claimed.

Source: woahwhattheheck/PayD:sol56/payd542-cashflow-auth-20261004 at ccb04f99bf1daa10b81892ffae00231f2aeea5a9.