fix: remove unused err in auth middleware, remove root package-lock.json

app/backend/middleware/auth.js

@@ -16,7 +16,7 @@ function requireAuth(req, res, next) {
     const decoded = jwt.verify(token, JWT_SECRET);
     req.user = decoded; // { id, email, name }
     next();
-  } catch (err) {
+  } catch  {
     return res.status(401).json({ error: "Invalid or expired token" });
   }
 }