feat: use OAuth Bearer token with write-discussions scope for likes

HF team confirmed the like endpoint accepts OAuth tokens. Switch back
to Bearer token auth (instead of credentials:'include') and add the
write-discussions scope which should cover like permissions.

Co-authored-by: Cursor <cursoragent@cursor.com>

README.md

@@ -6,6 +6,8 @@ colorTo: purple
 sdk: docker
 pinned: true
 hf_oauth: true
+hf_oauth_scopes:
+  - write-discussions
 thumbnail: >-
   https://cdn-uploads.huggingface.co/production/uploads/671faa3a541a76b548647676/XWNDlOu0R4fHXR0kCW3Wd.png
 short_description: All about Reachy Mini, from building to getting started

src/context/AuthContext.jsx

@@ -65,11 +65,12 @@ export function AuthProvider({ children }) {
         // Check if user just completed OAuth redirect
         const oauthResult = await oauthHandleRedirectIfPresent();
         if (oauthResult) {
-          const { userInfo } = oauthResult;
+          const { accessToken, userInfo } = oauthResult;
           const userData = {
             name: userInfo.name,
             preferredUsername: userInfo.preferred_username || userInfo.name,
             avatarUrl: userInfo.picture,
+            accessToken: accessToken,
           };
           setUser(userData);
 
@@ -125,8 +126,7 @@ export function AuthProvider({ children }) {
 
   /**
    * Toggle like/unlike with optimistic update.
-   * Uses credentials: 'include' to send HF session cookies — this works when
-   * the page is served from huggingface.co (same-origin with the API).
+   * Uses OAuth Bearer token (requires write-discussions scope).
    */
   const toggleLike = useCallback(
     async (spaceId) => {
@@ -159,7 +159,9 @@ export function AuthProvider({ children }) {
       try {
         const response = await fetch(`${HF_API}/api/spaces/${spaceId}/like`, {
           method,
-          credentials: 'include',
+          headers: {
+            Authorization: `Bearer ${user.accessToken}`,
+          },
         });
 
         if (!response.ok) {