fix(tokens): add requireAuth middleware to token routes

Token CRUD endpoints had no authentication guard.  Without it,
unauthenticated requests could reach the handler — GET would return
empty results silently, and POST could attempt to insert a token with
user_id = NULL.  All other route files in this codebase apply
requireAuth explicitly; tokens.js was simply missing it.

services/mam-api/src/routes/tokens.js

@@ -8,8 +8,10 @@
 import express from 'express';
 import crypto  from 'crypto';
 import pool    from '../db/pool.js';
+import { requireAuth } from '../middleware/auth.js';
 
 const router = express.Router();
+router.use(requireAuth);
 
 // Helper: get current user ID from session or req.user
 const userId = req => req.user?.id || req.session?.userId;