feat(confidence-engine): establish authenticated product boundary

lib/supabase/api-auth.js

@@ -0,0 +1,13 @@
+import { getAuthenticatedUser } from "@/lib/supabase/server.js";
+
+export function unauthorizedResponse() {
+  return Response.json({ error: "Unauthorized" }, { status: 401 });
+}
+
+export function withAuthenticatedApi(handler) {
+  return async function authenticatedApiHandler(request, context) {
+    const user = await getAuthenticatedUser();
+    if (!user) return unauthorizedResponse();
+    return handler(request, context);
+  };
+}