fix: complete audit security and frontend gaps

backend/internal/httpx/router.go

@@ -4,6 +4,7 @@ import (
 	"net/http"
 
 	"github.com/gin-gonic/gin"
+	"senlinai-agent/backend/internal/auth"
 	"senlinai-agent/backend/internal/config"
 )
 
@@ -12,6 +13,14 @@ type RouteRegistrar interface {
 }
 
 func NewRouter(cfg config.Config, registrars ...RouteRegistrar) *gin.Engine {
+	return newRouter(cfg, nil, registrars...)
+}
+
+func NewProtectedRouter(cfg config.Config, tokenVerifier func(string) (uint, error), registrars ...RouteRegistrar) *gin.Engine {
+	return newRouter(cfg, tokenVerifier, registrars...)
+}
+
+func newRouter(cfg config.Config, tokenVerifier func(string) (uint, error), registrars ...RouteRegistrar) *gin.Engine {
 	if cfg.Env == "test" {
 		gin.SetMode(gin.TestMode)
 	}
@@ -23,6 +32,9 @@ func NewRouter(cfg config.Config, registrars ...RouteRegistrar) *gin.Engine {
 		c.JSON(http.StatusOK, gin.H{"status": "ok"})
 	})
 	api := router.Group("/api")
+	if tokenVerifier != nil {
+		api.Use(auth.RequireUser(tokenVerifier))
+	}
 	for _, registrar := range registrars {
 		registrar.Register(api)
 	}