fix: implement authentication and identity validation

[Eren-Can-Donertas]

1. Description

The backend currently trusts client-provided identity headers without verification. Any client can impersonate another user by modifying headers. This creates a critical security and data integrity risk.

This work matters because unauthorized identity spoofing can affect reviews, wishlist actions, and notifications.

---

2. Ownership, Timeline, and Effort

Owner: @utkuatasoy
Given Date: 19-02-2026
Deadline: 22-02-2026 24:00
Hours: 8
Value: 3
Week: 8

---

3. Deliverables

• Authentication mechanism implemented
• Identity validation enforced
• Code merged into main branch

---

4. Scope Definition

In Scope

• Add authentication layer
• Validate user identity server-side

Out of Scope

• Role-based permission system expansion

---

5. Acceptance Criteria

• Unauthorized requests are rejected
• Identity spoofing prevented
• Auth validation applied to protected endpoints
• Pull request merged

---

6. Domain Specific Notes

Engineering: Token-based authentication assumed.

---

7. Validation and Review Requirements

• Security validation performed
• Code review completed
• Pull request merged

Definition of Done:
All protected endpoints require valid authentication and PR is merged.