BE41: Secure HTTPS Environment & User Ownership Enforcement

[TienNguyen3711]

Summary

• require authentication on user-scoped appointment, shopping list, recipe, chatbot, account, and water intake routes
• resolve target user IDs from req.user.userId for normal users, with override support only for privileged roles
• enforce ownership checks for appointment updates/deletes and shopping list item mutations

What files changed

• routes/account.js
• routes/appointment.js
• routes/chatbot.js
• routes/recipe.js
• routes/shoppingList.js
• routes/waterIntake.js
• controller/accountController.js
• controller/appointmentController.js
• controller/chatbotController.js
• controller/recipeController.js
• controller/shoppingListController.js
• model/appointmentModel.js
• services/shoppingListService.js
• validators/appointmentValidators.js
• validators/recipeValidator.js
• validators/shoppingListValidator.js

Testing

• node -c controller/appointmentController.js
• node -c services/shoppingListService.js
• node -c controller/chatbotController.js
• node -c controller/recipeController.js
• node -c routes/waterIntake.js
• node -c controller/accountController.js
• not run end-to-end