ReylanLugo
6aee5db588
Replace per-route apiKey/jwt branching with auth.projectId from middleware, matching the contacts controller pattern. Preserve JWT admin gating on POST/DELETE; API keys are project-scoped by design and skip the role check. Cross-project domain access by ID now returns 404 instead of 403 to avoid leaking existence.