Add auth checks for user routes and dashboard state

- tighten route authorization and schema handling
- update user route tests and server coverage
- refresh player dashboard behavior

.pico/history/2026-04-07T11-53-43-831Z-5b29ed09.json

@@ -0,0 +1,7 @@
+{
+  "timestamp": "2026-04-07T11:53:43.831Z",
+  "code": "import { spawnSync } from 'node:child_process';\n\n// Let's try to see the actual git log, which is the source of truth for \"what was built\"\ntry {\n  console.log(\"Fetching recent git commits...\\n\");\n  const gitLog = spawnSync('git', ['log', '-n', '15', '--pretty=format:%h - %s (%ad)', '--date=short'], { encoding: 'utf-8' });\n  \n  if (gitLog.stdout) {\n    console.log(gitLog.stdout);\n  } else {\n    console.log(\"No git log available.\");\n  }\n\n  // Also check if there are any recent changes in the source (not just dist) \n  // that might have been missed by the mtime scan of 'bot', 'shared', etc.\n  // We'll look for files modified in the last few days specifically in non-dist folders.\n} catch (e) {\n  console.error(\"Error retrieving git log:\", e);\n}\n",
+  "output": "Fetching recent git commits...\n\nNo git log available.\n",
+  "exitCode": 0,
+  "durationMs": 12
+}