Audit my app for routes and API endpoints that are only protected by the UI. Vibe-coded apps often hide a button or page behind a login check in the frontend while the underlying API endpoint answers any request that hits it directly. For every route and endpoint: identify what it does and who should be allowed to use it, then verify the server enforces that check itself. Add authentication and authorization middleware or guards wherever the check is missing. Pay special attention to admin pages, account settings, billing endpoints, and any endpoint that returns or modifies another user's data. Do not change the frontend routing or page structure. Do not add a new auth library if the project already has a session or token mechanism; extend what's there. Return clear 401 responses for unauthenticated requests and 403 for authenticated users who lack permission, rather than redirects that leak information. Give me a table of every endpoint, its protection status before and after, and the exact check you added. For each fix, include a curl command or equivalent I can run to confirm the endpoint now rejects unauthorized requests.