The auth middleware currently trusts the `X-User-Id` request header without verifying the session token, so any client can forge that header, impersonate any account, and read another user's private data. This change validates the signed session cookie on every request before the header is honored; a request with a missing or expired signature is rejected with 401 and never reaches the handler. @dana owns the gateway rollout and must ship this behind the `strict_auth` flag before Friday's launch, otherwise the impersonation hole goes live to every customer.
