fix(api): return 401 (not 500) on unauthenticated cards-collection writes

Follow-up to fix-auth-bypass Brief 2 (commit 258e479). Brief 2 made
getUserFromRequest return null for unauthenticated requests. POST, PUT,
and DELETE branches of pages/api/collections/[identifier]/cards.js
were dereferencing user.userId without a guard → NPE → HTTP 500.

Security side was already fixed by Brief 2 (no more
anonymous-write-as-admin on collections owned by userId: 1). This patch
adds the cosmetic 500 → 401 cleanup the Brief 2 reviewer flagged.

Three identical 'if (!user) return 401' guards added, one per write
branch. GET branch was already guarded via the ternary pattern.

Sibling endpoints under pages/api/collections/** were re-audited by the
implementer and confirmed correctly guarded (thumbnails, permissions,
activity all have early null checks; [identifier].js uses optional
chaining throughout). No further hotfixes needed for that route group.

Convoy: fix-auth-bypass / Brief 6 (post-architect hotfix)
Co-authored-by: Cursor <cursoragent@cursor.com>

pages/api/collections/[identifier]/cards.js

@@ -99,6 +99,10 @@ export default async function handler(req, res) {
       res.status(200).json({ cards });
 
     } else if (req.method === 'POST') {
+      if (!user) {
+        return res.status(401).json({ error: 'Authentication required to modify this collection' });
+      }
+
       // Add card to collection - only allow if user has write access
       const canWrite = collection.user_id === user.userId || 
                       ['owner', 'editor'].includes(collection.user_role);
@@ -160,6 +164,10 @@ export default async function handler(req, res) {
       `;
 
     } else if (req.method === 'PUT') {
+      if (!user) {
+        return res.status(401).json({ error: 'Authentication required to modify this collection' });
+      }
+
       // Update card quantity in collection
       const canWrite = collection.user_id === user.userId || 
                       ['owner', 'editor'].includes(collection.user_role);
@@ -209,6 +217,10 @@ export default async function handler(req, res) {
       `;
 
     } else if (req.method === 'DELETE') {
+      if (!user) {
+        return res.status(401).json({ error: 'Authentication required to modify this collection' });
+      }
+
       // Remove card from collection
       const canWrite = collection.user_id === user.userId || 
                       ['owner', 'editor'].includes(collection.user_role);