fix(security): authorize site uploads and harden tokens, media and request identity

src/app/api/articles/[slug]/comment/route.ts

@@ -16,7 +16,7 @@ export async function POST(
 	req: Request,
 	{ params }: { params: Promise<{ slug: string }> },
 ) {
-	const uid = await bearerUserId(req);
+	const uid = await bearerUserId(req, ["articles:write"]);
 	if (!uid) return apiError("Unauthorized", 401);
 
 	if (!(await rateLimit(`article-comment:${uid}`, 10, 60_000)).ok) {