Protected Routes (Backend)

Summary

The real security boundary — middleware that verifies a valid token/session before allowing a request to reach a protected endpoint's logic.

• 1Build auth middleware that rejects requests without a valid token.
• 2Apply it to every route that should require login, not just the ones the frontend currently guards.
• 3Test protected endpoints directly, via Postman, without going through the frontend, to confirm they're actually enforced.