Looking up someone's lists by username, and the catalog rows built from one,
went out without a token and came back empty. Both send one now, so a
connected account can browse and follow another user's public lists again.

- The by-username lists route takes a tokenId or a userUUID, and the AniList
  dialog sends what it holds.
- List catalog pages pass the configuration's token, and hold a rejection
  only for a reader who had one.
- The watched filter reuses the token it had already loaded.