Embed auth fix #3: validate token in /auth/{authenticated,user} directly

[lukemarsden]

Summary

PR #2289's /auth/authenticated fix didn't actually work because I missed that the endpoint is on insecureRouter — a separate subRouter that doesn't have extractMiddleware. So getRequestUser(r) always returned nil at the top of the handler.

E2E test confirmed: with the deployed code, curl -H "Authorization: Bearer hl-..." https://meta.helix.ml/api/v1/auth/authenticated still returns {"authenticated":false} even though the same Bearer token works fine on /api/v1/spec-tasks/....

Fix

In both /auth/authenticated and /auth/user handlers, resolve the token ourselves via s.authMiddleware.getUserFromToken(). That covers Authorization: Bearer, ?access_token=, and x-api-key callers.

Existing cookie / BFF session paths kept exactly as they were — this is purely an additional branch at the top of each handler.

Why two endpoints

The React app's account context loads the user in two steps:

1. /auth/authenticated → {authenticated: true} to skip the login redirect
2. /auth/user → user object to populate state

Both need to recognize the embed token, otherwise the app either redirects to /login (step 1 fails) or never finishes initialization (step 2 fails).

Test plan

• go build ./api/pkg/server/ clean
• After deploy: curl -H "Authorization: Bearer ${HELIX_API_KEY}" https://meta.helix.ml/api/v1/auth/authenticated returns {"authenticated":true}
• Embed iframe meta.helix.ml/embed/task/{id}?access_token={key} renders the task content (not the login redirect)

🤖 Generated with Claude Code