v3: code quality pass, various bug fixes

api/lib/auth.ts

@@ -0,0 +1,10 @@
+import type { Context } from "@oak/oak";
+import { verifyJWT } from "./jwt.ts";
+
+/** Extracts the userId from an optional Bearer token. Returns null if absent or invalid. */
+export async function parseOptionalAuth(ctx: Context): Promise<string | null> {
+  const authHeader = ctx.request.headers.get("Authorization");
+  if (!authHeader?.startsWith("Bearer ")) return null;
+  const payload = await verifyJWT(authHeader.substring(7));
+  return payload?.userId ?? null;
+}