fix(web): guard sessionStorage access for non-browser env

[LingMi1]

Fix npm test failing with sessionStorage is not defined in the Node/vitest environment.

• Add a sessionStorageAvailable() guard in web/src/api.ts so
  getApiToken/setApiToken no longer reference sessionStorage when
  running outside the browser.
• Update web/src/api.test.ts to match the new fetchReviews call
  signature ({ headers: {} }).