fix: require auth for subscriber APIs to prevent unauthenticated access

[carlhus]

fix(webconsole): require auth for subscriber APIs to prevent unauthenticated access (#1069)

• This PR fixes issue #1069 in WebConsole subscriber management.
  It prevents unauthenticated users from reading, modifying, or deleting subscriber records via subscriber APIs.

• Root cause: the /api route group did not have a global authentication middleware, and several subscriber handlers relied on per-handler checks that were missing or incomplete.

• Changes: Add JWT authentication middleware to the /api route group.
  Allow unauthenticated POST /api/login and OPTIONS preflight requests.
  Store parsed JWT claims, tenant ID, and admin status in Gin context.
  Enforce tenant ownership before subscriber GET/PUT/PATCH/DELETE operations.
  Stop using nil JWT claims when updating or deleting subscriber records.

• This is reported in GitHub Issue #1069.