Auth: use attachAuth context in controllers (eliminate duplicate DB lookups)

[CryptoJones]

Summary

router.js mounts attachAuth on all /v1/* routes, populating req.isMaster and req.companyId. Controllers still call IsMaster() and GetCompanyId() inline, adding 2+ DB round-trips per handler.

Proposed fix

• Migrate controllers to read req.isMaster / req.companyId from attachAuth
• Add requireAuth on routes that need strict 403 (except /v1/whoami)
• Remove redundant inline auth lookups

Acceptance criteria

• Controllers use request-scoped auth context
• No behavioral regression in auth tests
• Measurable reduction in auth DB queries per request

Source

Code review backlog (2026-06-23). Router comments already note this as follow-up work.