Require auth on /territories/* and POST /activities; derive user_id from session

Problem

The territory and activity write endpoints have no auth middleware and read user_id from the request body, so any caller can claim/conquer/record as any user (impersonation).

Evidence

• routes/api.ts — /activities (POST), /territories/{claim,process-conquest} are outside any route.group({ middleware: 'auth' }).
• app/Actions/Territory/ClaimTerritoryAction.ts / ProcessActivityConquestAction.ts / app/Actions/Activity/ActivityStoreAction.ts — const userId = request.get('user_id').

Acceptance

• Wrap territory + activity write routes in the auth middleware group.
• Derive user_id from Auth.user(), ignore any body-supplied user_id.
• Recorder/game-api send the bearer token; demo seeds a logged-in session for user 1.
• Unauthenticated writes return 401.

Done (commit a6b0bb5). Write endpoints (activities store/kudos/comments, territories claim/process-conquest) are now behind the auth middleware, and each action derives the acting user from Auth.user() — the request-body user_id is only an in-process (seed harness) fallback, never trusted over HTTP. Verified: with session=user3 and a spoofed body user_id=1, the action acts as user 3. Frontend uses the correct token key and auto-establishes the demo athlete's session so the loop keeps working under auth. GET reads remain public.