feat(api): tokens on all routes; items expose claims/claimedQuantity/remainingQuantity

app/api/settings/route.ts

@@ -1,7 +1,7 @@
 import { NextRequest, NextResponse } from 'next/server';
 import { eq } from 'drizzle-orm';
 import { db, settings } from '@/lib/db';
-import { verifyAccessToken } from '@/lib/auth/utils';
+import { verifyAdminToken } from '@/lib/auth/tokens';
 import crypto from 'crypto';
 
 // GET /api/settings - Get all settings (public endpoint for reading only)
@@ -42,21 +42,8 @@ export async function GET(request: NextRequest) {
 // PUT /api/settings - Update settings (admin only)
 export async function PUT(request: NextRequest) {
   try {
-    const token = request.cookies.get('access_token')?.value;
-
-    if (!token) {
-      return NextResponse.json(
-        { error: 'Not authenticated' },
-        { status: 401 }
-      );
-    }
-
-    const payload = verifyAccessToken(token);
-    if (!payload) {
-      return NextResponse.json(
-        { error: 'Invalid or expired token' },
-        { status: 401 }
-      );
+    if (!verifyAdminToken(request)) {
+      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
     }
 
     const body = await request.json();