fix: HIGH issues #12,#15,#16,#17,#21 — backend persistence for import/layers/blocks + owner filtering

backend/src/routes/projects.ts

@@ -7,10 +7,11 @@ import { requireAuth } from '../auth/authMiddleware.js';
 import type { AuthService } from '../auth/AuthService.js';
 
 export function registerProjectRoutes(fastify: FastifyInstance, db: DatabaseInterface, authService: AuthService) {
-  // List all projects
+  // List projects owned by the authenticated user
   fastify.get('/api/projects', async (request, reply) => {
-    if (!requireAuth(request, reply, authService)) return;
-    return db.listProjects();
+    const user = requireAuth(request, reply, authService);
+    if (!user) return;
+    return db.listProjects(user.id);
   });
 
   // Get single project
@@ -24,10 +25,11 @@ export function registerProjectRoutes(fastify: FastifyInstance, db: DatabaseInte
 
   // Create project
   fastify.post('/api/projects', async (request, reply) => {
-    if (!requireAuth(request, reply, authService)) return;
+    const user = requireAuth(request, reply, authService);
+    if (!user) return;
     const body = request.body as Partial<DBProject>;
     if (!body.name) return reply.code(400).send({ error: 'Name is required' });
-    return reply.code(201).send(db.createProject(body));
+    return reply.code(201).send(db.createProject({ ...body, owner_id: user.id }));
   });
 
   // Update project