// Session guard: rejects unauthenticated requests with 401 JSON.
// Identity is Mullvad-style (account tokens); token hashing lives in util/token.js.
export function requireAuth(req, res, next) {
  if (!req.session || !req.session.userId) {
    return res.status(401).json({ error: 'unauthorized' });
  }
  next();
}