3.9.1 JWT Protection

• All feature-specific endpoints (e.g., creating a post, initiating a copy trade) require an authenticated JWT.

• Higher-privilege actions (e.g., inviting new syndicate members, broadcasting trade signals) can check req.user.role.