Summary

The API currently accepts all requests without authentication (stub guards in api/guards.py). Implement a real authentication system for the REST and WebSocket API.

Design Spec Reference

• §12 Security & Approval System
• §13.2 API Surface
• api/guards.py — stub comment confirms M7 target

Scope

• Authentication middleware (technology TBD — reference spec for options)
• Token-based session management
• Integration with route guards (read/write access differentiation already stubbed)
• Secure credential handling

Notes

• The specific auth technology (JWT, OAuth2, API keys, or combination) should be evaluated at implementation time — reference DESIGN_SPEC.md for context
• Must work with the existing Litestar guard infrastructure