Require auth for message routes

[badabadabing]

/claim #743

Closes #4101

Summary

• Require authMiddleware for GET /api/messages and POST /api/messages.
• Store new messages with the authenticated token subject as senderId.
• Return only messages where the authenticated user is the sender or receiver.

Demo evidence

The API behavior is covered by apps/api/src/tests/messageRoutes.test.js:

• unauthenticated list/create requests return 401
• a spoofed request body senderId is ignored in favor of the authenticated user
• list responses are scoped to sender/receiver participation

Validation

• node --test apps/api/src/tests/messageRoutes.test.js
• node --check apps/api/src/services/messageService.js
• node --check apps/api/src/controllers/messageController.js
• node --check apps/api/src/routes/messageRoutes.js
• node --check apps/api/src/tests/messageRoutes.test.js
• git diff --check