Security: enforce backend Supabase JWT authentication

Problem

The frontend has Supabase login, but the FastAPI backend does not verify a Supabase JWT. Backend routes currently accept requests directly and trust caller-supplied identity fields such as user_id.

Affected areas observed:

• backend/api/main.py includes routers directly without auth middleware/dependencies.
• Chat, conversations, and billing routes accept identity via request body, query params, or headers instead of deriving it from a verified token.

Risk

Anyone who can reach the backend can call protected-looking endpoints without proving identity. This makes downstream ownership checks and billing checks unreliable.

Suggested fix

Add a shared FastAPI auth dependency that:

• validates Authorization: Bearer <Supabase JWT>;
• verifies issuer/audience/signature/expiry;
• derives the authenticated user id from the token subject;
• exposes a typed current-user object to route handlers;
• rejects unauthenticated requests with 401 where login is required.

Once this exists, route handlers should stop accepting trusted user_id values from clients.

Start in backend/api/main.py, then inspect the chat, conversations, and billing routes to trace how identity is currently accepted. Define the shared FastAPI dependency around the requested Supabase JWT checks and identify every protected route that must use it. Done means authenticated routes derive the user from the verified token, reject missing or invalid credentials with 401, and no longer trust client-supplied user_id values.