[SubhadeepAtta]

What does this PR do?

Adds optional authentication to the quiz joining endpoint (POST /join).

• Allows participants to join quizzes without providing an authentication token.
• Associates authenticated participants with their user ID when a valid JWT is provided.
• Handles invalid, malformed, or expired JWTs gracefully by allowing the participant to join anonymously.
• Preserves the existing anonymous quiz-joining flow.

Related issue

Related to #158 (already fixed in 6f104cd) — this tightens the type guard
in optionalAuthMiddleware.

Type of change

• Bug fix
• New feature
• Documentation
• Refactoring
• Performance
• Tests
• Build / CI / deployment

Which services does this touch?

• apps/frontend
• apps/http-server
• apps/ws-server
• apps/genAI
• packages/db (schema or Prisma changes)
• Docker / CI

How did you test this?

• Ran pnpm --filter http-server dev; TypeScript compilation completed and the server started on port 4000.
• The server reported a missing ApiRequestLog database table during request-log flushing.
• Postman testing of anonymous, valid-token, and invalid-token scenarios has not yet been completed.

Checklist

• I ran pnpm run lint
• I ran pnpm --filter http-server check-types
• I ran pnpm run build
• The app still starts with docker-compose up
• I updated documentation if this changes behaviour or setup
• I did not commit any .env file, API key or other secret

[TheCodeHeist-Coder]

Merging this for the type guard — the

typeof decoded.userId === "string" && decoded.userId.length > 0

check is stricter than what was there and matches organizerAuth.ts in
ws-server, so it's worth having.

One thing for next time: #158 was already fixed in 6f104cd, so
optionalAuthMiddleware already existed and was already wired to POST /join.
Worth pulling latest main and checking the code before starting on an issue
— saves you the work.

If you want something more substantial, that middleware has no test coverage
at all. Tests for it would be genuinely useful: no header, malformed header,
valid token, expired token, token with no userId claim. http-server has
vitest set up now.