fix: address code review issues — MCP auth, error handling, password route

- MCP auth middleware now rejects requests without API key when users exist
- Image /from-url route distinguishes validation errors (400) from server errors (500)
- Password change route returns 401 when no session cookie instead of crashing

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/server/routes/auth.ts

@@ -121,8 +121,15 @@ app.put(
 	zValidator("json", changePasswordSchema),
 	async (c) => {
 		const db = c.get("db");
-		const sessionId = getCookie(c, COOKIE_NAME)!;
-		const session = getSession(db, sessionId)!;
+		const sessionId = getCookie(c, COOKIE_NAME);
+		if (!sessionId) {
+			return c.json({ error: "Session required for password change" }, 401);
+		}
+		const session = getSession(db, sessionId);
+
+		if (!session) {
+			return c.json({ error: "Session required for password change" }, 401);
+		}
 
 		const userRecord = db
 			.select()