Fix user default surface by reading JWT from cookie

The GET / route has no auth middleware, so user_id was always
empty. Add UserIDFromCookie helper that opportunistically reads
the sb_token cookie and extracts user_id without requiring auth.
Now user preference correctly overrides the global default.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

server/middleware/auth.go

@@ -142,6 +142,21 @@ func parseAndValidateJWT(tokenString string, jwtSecret string) (*Claims, bool) {
 	return claims, true
 }
 
+// UserIDFromCookie extracts the user ID from the sb_token cookie without
+// requiring authentication. Returns "" if no valid token is found.
+// Used by unauthenticated routes that want optional user context.
+func UserIDFromCookie(c *gin.Context, jwtSecret string) string {
+	cookie, err := c.Cookie("sb_token")
+	if err != nil || cookie == "" {
+		return ""
+	}
+	claims, ok := parseAndValidateJWT(cookie, jwtSecret)
+	if !ok {
+		return ""
+	}
+	return claims.UserID
+}
+
 // ─── Auth middleware ─────────────────────────────────────────
 
 // Auth returns a Gin middleware that validates JWT bearer tokens and