auth.middleware.ts

The app sends: Authorization: Bearer plus the access token string.
This file checks:

1. Header exists and starts with Bearer
2. Token verifies as a valid JWT (TokenService)
3. User still exists in MongoDB

If OK, it puts userId and user on the context so routes can do c.get('user').

Success → route sees

c.get('userId')  // string
c.get('user')    // { id, email, name, avatar, isOnboarded, isAdmin, adminRole }

Failure → 401 JSON

• Missing header
• Bad/expired token
• User deleted from DB

Friends

• services/token.service.ts — sign/verify JWT
• models/user.model.ts — load user row
• types/index.ts — HonoEnv types for c.get

Used on most /api/v1/users/* and many authenticated routes.