Refactor handlers to use MustGetUserID

- Fix: replace repeated authorization checks in handlers with the new
  MustGetUserID helper, which panics if the user ID is missing. This
  simplifies handler code by eliminating redundant error handling.
- Tests: update auth tests to verify the panic behavior in unprotected
  routes.

internal/handler/file.go

@@ -40,7 +40,7 @@ type updateFileRequest struct {
 // If the content type is multipart/form-data, it uploads a file.
 // If the content type is application/json, it creates a directory.
 func (h *FileHandler) Upload(c *gin.Context) {
-	userID := middleware.GetUserID(c)
+	userID := middleware.MustGetUserID(c)
 	contentType := c.GetHeader("Content-Type")
 
 	// Directory creation via JSON.
@@ -97,7 +97,7 @@ func (h *FileHandler) Upload(c *gin.Context) {
 
 // List handles GET /api/v1/files.
 func (h *FileHandler) List(c *gin.Context) {
-	userID := middleware.GetUserID(c)
+	userID := middleware.MustGetUserID(c)
 
 	parentIDStr := c.Query("parent_id")
 	var parentID *string
@@ -131,7 +131,7 @@ func (h *FileHandler) List(c *gin.Context) {
 
 // Get handles GET /api/v1/files/:id.
 func (h *FileHandler) Get(c *gin.Context) {
-	userID := middleware.GetUserID(c)
+	userID := middleware.MustGetUserID(c)
 	fileID := c.Param("id")
 
 	info, err := h.fileService.Get(c.Request.Context(), userID, fileID)
@@ -145,7 +145,7 @@ func (h *FileHandler) Get(c *gin.Context) {
 
 // Download handles GET /api/v1/files/:id/content.
 func (h *FileHandler) Download(c *gin.Context) {
-	userID := middleware.GetUserID(c)
+	userID := middleware.MustGetUserID(c)
 	fileID := c.Param("id")
 
 	reader, info, err := h.fileService.Download(c.Request.Context(), userID, fileID)
@@ -170,7 +170,7 @@ func (h *FileHandler) Download(c *gin.Context) {
 
 // Update handles PUT /api/v1/files/:id.
 func (h *FileHandler) Update(c *gin.Context) {
-	userID := middleware.GetUserID(c)
+	userID := middleware.MustGetUserID(c)
 	fileID := c.Param("id")
 
 	var req updateFileRequest
@@ -196,7 +196,7 @@ func (h *FileHandler) Update(c *gin.Context) {
 
 // Delete handles DELETE /api/v1/files/:id.
 func (h *FileHandler) Delete(c *gin.Context) {
-	userID := middleware.GetUserID(c)
+	userID := middleware.MustGetUserID(c)
 	fileID := c.Param("id")
 
 	if err := h.fileService.Delete(c.Request.Context(), userID, fileID); err != nil {