fix(security): authorize site uploads and harden tokens, media and request identity

src/app/api/tickets/[id]/route.ts

@@ -19,7 +19,7 @@ export async function GET(
 	req: Request,
 	{ params }: { params: Promise<{ id: string }> },
 ) {
-	const uid = await bearerUserId(req);
+	const uid = await bearerUserId(req, ["tickets:read"]);
 	if (!uid) return apiError("Unauthorized", 401);
 
 	const { id } = await params;