Auth middleware refactor

You:

Can you refactor the auth middleware to use JWT instead of session cookies? The current setup doesn't scale well across our microservices.

Claude:

I'll refactor the auth middleware to use JWT. Here's my plan:

1. Replace express-session with a new verifyToken middleware

2. Add token generation in the login route with 24h expiry

3. Update the 6 protected routes to use the new middleware

Let me start by modifying src/middleware/auth.ts