💡refactor auth — finally
Been staring at the same auth check copy-pasted across 9 handlers. Moving it to middleware. Should delete ~40 lines and finally make the codebase feel sane.
Token refresh is also duplicated in three places — same fix. Want to prototype this tonight before I forget the mental model.

