refactor(stage-4): partition monolithic main.py into modular APIRouters

app/auth.py

@@ -4,6 +4,7 @@ import secrets
 import time
 from datetime import datetime, timezone, timedelta
 from typing import Optional
+from fastapi import Request, HTTPException, status
 from app import config
 from app.database import get_db
 
@@ -136,3 +137,24 @@ def ensure_admin_user():
         if count == 0 and config.ADMIN_PASSWORD:
             create_user(config.ADMIN_USERNAME, config.ADMIN_PASSWORD)
 
+
+def get_optional_user(request: Request) -> Optional[dict]:
+    token = request.cookies.get(config.SESSION_COOKIE_NAME)
+    if not token:
+        auth_header = request.headers.get("Authorization", "")
+        if auth_header.startswith("Bearer "):
+            token = auth_header[7:].strip()
+    if token:
+        return get_user_from_session(token)
+    return None
+
+
+def require_user(request: Request) -> dict:
+    user = get_optional_user(request)
+    if not user:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="Authentication required",
+        )
+    return user
+