Add auth checks for user routes and dashboard state

- tighten route authorization and schema handling
- update user route tests and server coverage
- refresh player dashboard behavior

.pico/history/2026-04-07T11-53-08-595Z-5caf0514.json

@@ -0,0 +1,7 @@
+{
+  "timestamp": "2026-04-07T11:53:08.595Z",
+  "code": "import { readdirSync, statSync } from 'node:fs';\nimport { join } from 'node:path';\n\nfunction walk(dir) {\n  let results = [];\n  const list = readdirSync(dir);\n  for (const file of list) {\n    const fullPath = join(dir, file);\n    const stat = statSync(fullPath);\n    if (stat.isDirectory()) {\n      results = results.concat(walk(fullPath));\n    } else {\n      results.push({ path: fullPath, mtime: stat.mtime });\n    }\n  }\n  return results;\n}\n\nconst searchDirs = [\n  'bot',\n  'shared',\n  'api',\n  'panel'\n];\n\nconsole.log(\"Scanning project files for recent modifications...\\n\");\n\nlet allFiles = [];\n\nfor (const dir of searchDirs) {\n  if (readdirSync(dir)) {\n    try {\n      allFiles = allFiles.concat(walk(dir));\n    } catch (e) {\n      // Skip dirs that might not be accessible or exist\n    }\n  }\n}\n\n// Sort by modification time descending\nallFiles.sort((a, b) => b.mtime.getTime() - a.mtime.getTime());\n\nconsole.log(\"Top 20 most recently modified files:\");\nallFiles.slice(0, 20).forEach((file, index) => {\n  console.log(`${index + 1}. ${file.path} (${file.mtime.toISOString()})`);\n});\n\n// Also check git log via spawnSync\ntry {\n  const { spawnSync } = require('node:child_process');\n  const gitLog = spawnSync('git', ['log', '-n', '10', '--pretty=format:%h - %s (%ad)', '--date=short'], { encoding: 'utf-8' });\n  if (gitLog.stdout) {\n    console.log(\"\\n--- Recent Git Commits ---\");\n    console.log(gitLog.stdout);\n  }\n} catch (e) {\n  console.log(\"\\nCould not retrieve git logs.\");\n}\n",
+  "output": "Scanning project files for recent modifications...\n\nTop 20 most recently modified files:\n1. panel/dist/static/ort-wasm-simd-threaded.jsep-D5Jk56-t.wasm (2026-04-06T13:17:58.691Z)\n2. panel/dist/index.html (2026-04-06T13:17:58.688Z)\n3. panel/dist/static/ort.webgpu.bundle.min-BNEHy6AC.js (2026-04-06T13:17:58.688Z)\n4. panel/dist/static/index-DmKkELn8.js (2026-04-06T13:17:58.688Z)\n5. panel/dist/static/ort.bundle.min-OfoG_cy9.mjs (2026-04-06T13:17:58.688Z)\n6. panel/dist/static/index-C8-HdrKI.js (2026-04-06T13:17:58.688Z)\n7. panel/dist/static/index-DzF7ilDD.css (2026-04-06T13:17:58.688Z)\n8. panel/dist/static/ort.bundle.min-BgViPGHg.js (2026-04-06T13:17:58.688Z)\n9. panel/dist/static/ort.webgpu.bundle.min-CEayb2S6.mjs (2026-04-06T13:17:58.688Z)\n10. panel/dist/cards/queen_of_spades.svg (2026-04-06T13:17:58.508Z)\n11. panel/dist/cards/queen_of_diamonds.svg (2026-04-06T13:17:58.507Z)\n12. panel/dist/cards/queen_of_clubs.svg (2026-04-06T13:17:58.507Z)\n13. panel/dist/cards/queen_of_hearts.svg (2026-04-06T13:17:58.507Z)\n14. panel/dist/cards/king_of_hearts.svg (2026-04-06T13:17:58.506Z)\n15. panel/dist/cards/king_of_spades.svg (2026-04-06T13:17:58.506Z)\n16. panel/dist/cards/king_of_clubs.svg (2026-04-06T13:17:58.505Z)\n17. panel/dist/cards/jack_of_spades.svg (2026-04-06T13:17:58.505Z)\n18. panel/dist/cards/king_of_diamonds.svg (2026-04-06T13:17:58.505Z)\n19. panel/dist/cards/jack_of_hearts.svg (2026-04-06T13:17:58.504Z)\n20. panel/dist/cards/jack_of_diamonds.svg (2026-04-06T13:17:58.504Z)\n",
+  "exitCode": 0,
+  "durationMs": 494
+}