feat(16-03): wire userId from context into all route handlers

- Extract userId via c.get('userId') in every route handler
- Pass userId to all service function calls as second argument
- Update settings routes to use composite key [userId, key]
- Update Env type to include userId in Variables
- Auth routes pass userId to API key management functions

src/server/routes/auth.ts

@@ -10,7 +10,7 @@ import {
 	listApiKeys,
 } from "../services/auth.service.ts";
 
-type Env = { Variables: { db?: any } };
+type Env = { Variables: { db?: any; userId?: number } };
 
 const createKeySchema = z.object({ name: z.string().min(1) });
 
@@ -33,7 +33,8 @@ app.get("/me", async (c) => {
 
 app.get("/keys", requireAuth, async (c) => {
 	const db = c.get("db");
-	const keys = await listApiKeys(db);
+	const userId = c.get("userId")!;
+	const keys = await listApiKeys(db, userId);
 	return c.json(keys);
 });
 
@@ -43,8 +44,9 @@ app.post(
 	zValidator("json", createKeySchema),
 	async (c) => {
 		const db = c.get("db");
+		const userId = c.get("userId")!;
 		const { name } = c.req.valid("json");
-		const result = await createApiKey(db, name);
+		const result = await createApiKey(db, userId, name);
 
 		return c.json(
 			{
@@ -60,9 +62,10 @@ app.post(
 
 app.delete("/keys/:id", requireAuth, async (c) => {
 	const db = c.get("db");
+	const userId = c.get("userId")!;
 	const id = parseId(c.req.param("id"));
 	if (!id) return c.json({ error: "Invalid key ID" }, 400);
-	await deleteApiKey(db, id);
+	await deleteApiKey(db, userId, id);
 	return c.json({ ok: true });
 });