fix: add optionalAuth to public pages and fix Addie content creation

[bokelley]

Summary

• Add optionalAuth middleware to /latest/* routes so users show as logged in
• Add optionalAuth middleware to /events/* routes for same reason
• Extract proposeContentForUser function from HTTP route handler
• Update Addie's propose_content tool to call function directly instead of HTTP
• This fixes silent content creation failures caused by 401 Unauthorized errors

Background

1. Users were not showing as logged in on public pages (/latest/research, /events) because those routes didn't have optionalAuth middleware
2. Addie's content creation was silently failing because callApi made HTTP requests without proper auth headers, resulting in 401 errors

Implementation

The direct function call approach is more secure than adding ADMIN_API_KEY to internal HTTP requests:

• No admin credentials exposed
• Works within the same process
• Uses proper user context for authorization checks

Uses dynamic import to avoid pulling auth.ts at module load time which affected test suite initialization.

Test plan

• Build passes
• All 241 tests pass
• Verified with Vibium that logged-in status shows correctly on /latest/research

🤖 Generated with Claude Code