feat(api): add auth middleware to protect game endpoints

- Add requireAuth middleware using Better Auth session validation
- Apply to all game routes (start, answer)
- Unauthenticated requests return 401

documentation/notes.md

@@ -7,6 +7,10 @@
 
 ## problems+thoughts
 
+### try now option
+
+there should be an option to try the app without an account so users can see what they would get when creating an account
+
 ### resolve deps problem
 
 ﬌ pnpm --filter web add better-auth