fix: complete audit security and frontend gaps

backend/internal/inbox/handlers.go

@@ -5,6 +5,7 @@ import (
 	"strconv"
 
 	"github.com/gin-gonic/gin"
+	"senlinai-agent/backend/internal/auth"
 )
 
 type Handler struct {
@@ -22,6 +23,11 @@ func (h *Handler) Register(router gin.IRouter) {
 }
 
 func (h *Handler) capture(c *gin.Context) {
+	userID, ok := auth.CurrentUserID(c)
+	if !ok {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": "missing current user"})
+		return
+	}
 	projectID, err := strconv.ParseUint(c.Param("projectID"), 10, 64)
 	if err != nil {
 		c.JSON(http.StatusBadRequest, gin.H{"error": "invalid project id"})
@@ -36,7 +42,7 @@ func (h *Handler) capture(c *gin.Context) {
 		c.JSON(http.StatusBadRequest, gin.H{"error": "invalid request"})
 		return
 	}
-	item, err := h.service.Capture(CaptureInput{ProjectID: uint(projectID), UserID: 1, SourceType: input.SourceType, Title: input.Title, Body: input.Body})
+	item, err := h.service.Capture(CaptureInput{ProjectID: uint(projectID), UserID: userID, SourceType: input.SourceType, Title: input.Title, Body: input.Body})
 	if err != nil {
 		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
 		return
@@ -45,12 +51,17 @@ func (h *Handler) capture(c *gin.Context) {
 }
 
 func (h *Handler) analyze(c *gin.Context) {
+	userID, ok := auth.CurrentUserID(c)
+	if !ok {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": "missing current user"})
+		return
+	}
 	itemID, err := strconv.ParseUint(c.Param("id"), 10, 64)
 	if err != nil {
 		c.JSON(http.StatusBadRequest, gin.H{"error": "invalid inbox id"})
 		return
 	}
-	suggestions, err := h.service.Analyze(uint(itemID), 1)
+	suggestions, err := h.service.Analyze(uint(itemID), userID)
 	if err != nil {
 		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
 		return