Frontend does not send JWTs to the backend

Problem

Frontend API calls do not consistently authenticate requests to the backend.

Observed behavior:

• Generic API calls send only Content-Type.
• Chat sends X-User-Id and body user_id, but does not send Authorization: Bearer <token>.
• The Next.js proxy drops auth headers instead of forwarding them to the backend.

Risk

The backend cannot distinguish an authenticated caller from a spoofed caller-supplied user identifier. Any endpoint that trusts X-User-Id or user_id is therefore not using a real auth boundary.

Expected behavior

Frontend requests that access user-specific data or spend should include a verified auth token, and proxy routes should preserve the Authorization header.

Acceptance criteria

• Frontend API helpers attach Authorization: Bearer <token> where backend auth is required.
• The Next.js proxy forwards auth headers to the backend.
• Backend protected endpoints reject missing or invalid tokens.
• Tests cover authenticated and unauthenticated frontend/backend request paths.

Start by locating the frontend API helpers, Next.js proxy routes, and backend protected endpoints described in the issue. Trace how authenticated and unauthenticated requests currently behave, then add coverage for token forwarding, rejection of missing or invalid tokens, and user-specific request paths until all acceptance criteria pass.