Let's design a JWT auth module for this Express API. Look at the existing routes under src/routes/ and give me a plan we can implement.
Here's the plan: 1. src/auth/jwt.ts — wrap jsonwebtoken with sign(payload) / verify(token) helpers that read JWT_SECRET from env. Fail fast on startup if it's missing. 2. src/middleware/require-auth.ts — Express middleware that pulls the Authorization: Bearer … header, verifies, and attaches req.user. Returns 401 on missing/invalid. 3. src/routes/auth.ts — new routes for POST /login and POST /refresh. Password check goes through the existing users service. 4. Wire auth.ts into src/routes/index.ts and add requireAuth to the posts routes that shouldn't be public. Want me to implement it now, or tweak the shape first?