auth_middleware.py— JWT (HS256) verification. Checks every request except/ping, docs routes, and/auth/register//auth/login. On success, attachesrequest.state.user_id.
- This is single-mode auth (local JWT only) — no SSO. If you need SSO, that's the advanced tier's dual-mode middleware.
request.state.user_idis the only thing routers should trust for identity — don't accept auser_idfrom a request body or query param as an alternative source of truth.