[HIGH] fix(security): require auth on /api/auth/salt to prevent PBKDF2 salt oracle

[katnisscalls99]

Previously GET /api/auth/salt?phone=+1234567890 required no authentication, letting any caller retrieve any user's PBKDF2 salt by phone number. Because the salt is an input to the master-key derivation (PBKDF2-SHA256), leaking it converts an online attack into an offline dictionary/brute-force attack.

Reproduction:

curl 'https://qryptchat.com/api/auth/salt?phone=%2B15551234567'
# → {"salt":"[1,2,3,...]"}   ← no credentials required

Changes:

• Add authenticateUser() helper (mirrors pattern in backup-pin and key-backup)
• GET now requires a valid session and returns only the caller's own salt
• POST now requires a valid session and scopes the upsert to auth_user_id
• Remove the phone-number query-string parameter from both endpoints; the client-side MasterKeyDerivation.fetchOrCreateSalt() call will automatically send the session cookie / Bearer token that the helper reads.

Severity: HIGH — enables offline brute-force of user PINs / master keys