Require a login and limit each user to their own hotels #81

Part of Pair 3: feedback that trains the model (Geo + Bhuvan), under #99. Stretch for this week. Blocked by #80.

Problem

Every API route is open. Once a hotel's revenue data and prices are on a live server, anyone with the URL could read or change them, and with open sign-up any Google account could sign in.

Goal

Every route except /health and the sign-in routes needs a signed-in user, and each user can only see and change the hotels they're linked to.

Scope

• A dependency that loads the signed-in user from the session; requests without a valid session get 401.
• Apply it to every route except /health and /auth/*.
• Check hotel access on every route that touches a hotel's data, including ones reached by their own ID (jobs, models, recommendations, room types), not only /hotels/{id}/....
• GET /hotels lists only the user's hotels.
• Make the signed-in user available to services, so later features can record who made a decision.
• The API docs show which routes need a login.
• Update existing tests to sign in.
• A route for linking a user to a hotel, replacing the just link-user command (cli.py), with a new decision record superseding 0036. Decide who may link users.

Considerations

• Return 404, not 403, for a hotel the user isn't linked to, so hotel IDs aren't revealed.
• Creating hotels and cities: decide whether any signed-in user can do it, or only us, until onboarding exists.
• No scheduler exists yet (Collect events and weather every day #70). When it does, it needs its own credentials (e.g. a service token) or must stop calling over HTTP; decide which here.

Acceptance criteria

• Every route except /health and /auth/* returns 401 without a valid session.
• A user linked to hotel A gets 404 for hotel B's data on every route, including jobs and models.
• A signed-in user with no hotel sees no hotels.
• How the scheduler will authenticate is decided and written down.
• Linking a user to a hotel works through the API, and just link-user is removed.
• Tests cover the 401s and access between hotels.