Auth middleware

One guard for every protected route

Now the app sends Authorization: Bearer <token> on each request. You could copy the same verify-the-token code into every handler — but that's the exact thing middleware exists to prevent. Middleware is a function that wraps a handler: it runs first, decides whether the request may proceed, and either calls the next handler or rejects the request.

One RequireAuth middleware, wrapped around your bookings and walk routes, means every protected endpoint is guarded by the same audited code. Public routes (login, signup, the health check) simply aren't wrapped.