Use auth middleware and remove userId from save route

[SAK001-WB]

Description:
This PR updates the POST /api/save route to use authentication middleware (protect) instead of accepting userId in the request body. The authenticated user's ID is now securely extracted from the JWT token.

Changes:

Applied protect middleware to /api/save route

Removed userId from client request body

Extracted userId from req.user (populated via verified token)

Preserved existing error handling and Prisma logic

Why:
To prevent unauthorized users from saving pins on behalf of other users and to follow security best practices by trusting only verified user identities.