feat(week8): JWT auth, SSM Parameter Store, and UI overhaul

app/backend/middleware/auth.js

@@ -0,0 +1,24 @@
+const jwt = require("jsonwebtoken");
+
+const JWT_SECRET = process.env.JWT_SECRET || "changeme-use-a-real-secret-in-production";
+
+// Protects routes - attaches req.user if token is valid
+function requireAuth(req, res, next) {
+  const header = req.headers.authorization;
+
+  if (!header || !header.startsWith("Bearer ")) {
+    return res.status(401).json({ error: "No token provided" });
+  }
+
+  const token = header.split(" ")[1];
+
+  try {
+    const decoded = jwt.verify(token, JWT_SECRET);
+    req.user = decoded; // { id, email, name }
+    next();
+  } catch (err) {
+    return res.status(401).json({ error: "Invalid or expired token" });
+  }
+}
+
+module.exports = { requireAuth, JWT_SECRET };