feat: rebuild fiscal clone architecture and harden coolify deployment

backend/src/session.ts

@@ -0,0 +1,30 @@
+import { auth } from './auth';
+import type { SessionUser } from './types';
+
+export class UnauthorizedError extends Error {
+  constructor(message = 'Authentication required') {
+    super(message);
+    this.name = 'UnauthorizedError';
+  }
+}
+
+export async function requireSessionUser(request: Request): Promise<SessionUser> {
+  const session = await auth.api.getSession({ headers: request.headers });
+
+  if (!session?.user?.id) {
+    throw new UnauthorizedError();
+  }
+
+  const userId = Number(session.user.id);
+
+  if (!Number.isFinite(userId)) {
+    throw new UnauthorizedError('Invalid session user id');
+  }
+
+  return {
+    id: userId,
+    email: session.user.email,
+    name: session.user.name ?? null,
+    image: session.user.image ?? null
+  };
+}