fix(security): implement widget API authentication with JWT verification

[JasonOA888]

Vulnerability: Widget API Endpoints Have No Authentication (P0)

Summary

The Widget API authentication functions authCheck and clientIdCheck in apps/rowboat/app/api/widget/v1/utils.ts were returning 501 Not Implemented with the actual JWT verification code commented out. This means all Widget API endpoints that depend on these middleware functions are effectively unauthenticated — any request is rejected, but more critically, the intended security boundary does not exist.

Impact

• Unauthenticated API access: Widget API endpoints that should require authentication are completely unprotected since the auth middleware always returns 501 instead of performing real validation.
• If the 501 is bypassed (e.g., a developer removes the stub), the JWT verification would still be non-functional since it was commented out.

Fix

1. Uncommented and activated authCheck: Now properly verifies JWT tokens using jose.jwtVerify with the CHAT_WIDGET_SESSION_JWT_SECRET environment variable. Returns appropriate 400/403 errors for missing or invalid tokens.

2. Uncommented and activated clientIdCheck: Validates the x-client-id header and looks up the project using the existing IProjectsRepository.fetch() method. Returns 400 if missing, 403 if invalid.

3. Added startup validation: If CHAT_WIDGET_SESSION_JWT_SECRET is not set or empty, the application throws a fatal error at startup rather than silently running without authentication. This ensures misconfigured deployments fail loudly.

4. Removed the return new Response("Not implemented", { status: 501 }) stubs — both functions now perform real authentication.

Test Plan

• Start the app without CHAT_WIDGET_SESSION_JWT_SECRET set — should throw a startup error
• Call a Widget API endpoint without Authorization header — should return 400
• Call with an invalid/expired JWT — should return 403
• Call with a valid JWT signed with the correct secret — should pass authentication
• Call with missing x-client-id header — should return 400
• Call with a valid project ID as client ID — should pass