fix: complete audit security and frontend gaps

backend/cmd/api/main.go

@@ -3,6 +3,7 @@ package main
 import (
 	"log"
 
+	"senlinai-agent/backend/internal/auth"
 	"senlinai-agent/backend/internal/config"
 	"senlinai-agent/backend/internal/db"
 	"senlinai-agent/backend/internal/domain"
@@ -21,10 +22,11 @@ func main() {
 		log.Fatal(err)
 	}
 
+	authService := auth.NewService(database, cfg.AuthSecret)
 	projectHandler := projects.NewHandler(projects.NewService(database))
 	inboxHandler := inbox.NewHandler(inbox.NewService(database, inbox.StaticAnalyzer{}))
-	router := httpx.NewRouter(cfg, projectHandler, inboxHandler)
-	if err := router.Run(":8080"); err != nil {
+	router := httpx.NewProtectedRouter(cfg, authService.VerifySession, projectHandler, inboxHandler)
+	if err := router.Run(":" + cfg.Port); err != nil {
 		log.Fatal(err)
 	}
 }