feat: Lock down server actions to authenticated users only
Protects against:
Even if UI breaks, backend is safe This is real security, not just routing