Unify auth guards to withAuthResult / withAuthResultRateLimit wrappers #150

Summary

Auth guards are applied inconsistently across server actions — three different patterns coexist.

Source

Semantic Review SR-007 (2026-02-18), verified 2026-02-25

Current State (verified)

Auth wrapper variants in auth-guard.ts:

• withAuth — returns raw T (no ActionResult pattern)
• withAuthRateLimit — returns raw T + rate limiting
• withAuthResultRateLimit — returns ActionResult + rate limiting ← target pattern

Acceptance Criteria

• All mutation server actions use withAuthResultRateLimit wrapper
• All read-only server actions use withAuthResult (or equivalent) wrapper
• No inline createClient() + getUser() auth checks remain in action files
• withAuth and withAuthRateLimit removed from auth-guard.ts (dead code after migration)
• All tests passing

Priority

🔴 High — Security pattern consistency

Notes

Resolving this issue will also partially address #149 (ActionResult standardization) and #156 (rate limiting coverage).