Refactor handlers to use MustGetUserID

- Fix: replace repeated authorization checks in handlers with the new
  MustGetUserID helper, which panics if the user ID is missing. This
  simplifies handler code by eliminating redundant error handling.
- Tests: update auth tests to verify the panic behavior in unprotected
  routes.

internal/handler/account.go

@@ -27,22 +27,13 @@ type createPasskeyRequest struct {
 
 // GetAccount handles GET /api/v1/account.
 func (h *AccountHandler) GetAccount(c *gin.Context) {
-	userID := middleware.GetUserID(c)
-	if userID == "" {
-		api.Error(c, http.StatusUnauthorized, "unauthorized")
-		return
-	}
-
+	userID := middleware.MustGetUserID(c)
 	c.JSON(http.StatusOK, gin.H{"user_id": userID})
 }
 
 // ListPasskeys handles GET /api/v1/account/passkeys.
 func (h *AccountHandler) ListPasskeys(c *gin.Context) {
-	userID := middleware.GetUserID(c)
-	if userID == "" {
-		api.Error(c, http.StatusUnauthorized, "unauthorized")
-		return
-	}
+	userID := middleware.MustGetUserID(c)
 
 	creds, err := h.authService.ListPasskeys(c.Request.Context(), userID)
 	if err != nil {
@@ -59,11 +50,7 @@ func (h *AccountHandler) ListPasskeys(c *gin.Context) {
 
 // CreatePasskey handles POST /api/v1/account/passkeys.
 func (h *AccountHandler) CreatePasskey(c *gin.Context) {
-	userID := middleware.GetUserID(c)
-	if userID == "" {
-		api.Error(c, http.StatusUnauthorized, "unauthorized")
-		return
-	}
+	userID := middleware.MustGetUserID(c)
 
 	var req createPasskeyRequest
 	if err := c.ShouldBindJSON(&req); err != nil {
@@ -82,11 +69,7 @@ func (h *AccountHandler) CreatePasskey(c *gin.Context) {
 
 // RevokePasskey handles DELETE /api/v1/account/passkeys/:id.
 func (h *AccountHandler) RevokePasskey(c *gin.Context) {
-	userID := middleware.GetUserID(c)
-	if userID == "" {
-		api.Error(c, http.StatusUnauthorized, "unauthorized")
-		return
-	}
+	userID := middleware.MustGetUserID(c)
 
 	passkeyID := c.Param("id")
 	if passkeyID == "" {