4704d33b4a
The receipt <a href target=_blank> was an unauthenticated browser navigation that the API's [Authorize] rejects with 401. Replace with a HttpClient blob download (downloadReceipt) so the auth interceptor attaches the JWT, opened via an object URL. Also fix the delete button: confirm() must run inside the component method (matching givings-page), not as a template expression where confirm is not a component member.