Fix: Add authentication and ownership checks to health-data [id] API routes

[RohithVangalla1]

The GET, PATCH, and DELETE endpoints for individual health data records had no authentication or authorization checks. Any unauthenticated request with a valid record ID could read, modify, or delete any user's health data — a critical security vulnerability for a health application.

This change:

• Adds session authentication check (returns 401 if not logged in)
• Adds ownership verification using authorId (returns 404 if the record doesn't belong to the current user, preventing IDOR attacks)
• Uses findFirst with authorId filter instead of findUniqueOrThrow to avoid leaking existence of other users' records via error messages

The parent route (/api/health-data) already had these checks — this brings the [id] sub-route to the same security standard.

---

name: Add authentication and ownership checks to health-data [id] routes
about: Adds missing authentication and authorization checks to the /api/health-data/[id]
GET, PATCH, and DELETE endpoints.

What's changed?

The individual health data record endpoints had no authentication or authorization
checks. Any unauthenticated request with a valid record ID could:

• Read any user's health data (GET)
• Modify any user's health data (PATCH)
• Delete any user's health data (DELETE)

This is a critical security vulnerability (IDOR - Insecure Direct Object Reference)
for a health application handling sensitive patient data.

The parent route (/api/health-data) already has proper auth() checks — this
sub-route was missing them.

Fix

• Added auth() session check → returns 401 if not logged in
• Added ownership verification via authorId filter → returns 404 if the record
  doesn't belong to the current user
• Uses findFirst with authorId instead of findUniqueOrThrow to avoid leaking
  existence of other users' records

Type of change

• Security fix

✨ Screenshots (optional)

[gemini-code-assist]

Code Review

This pull request introduces authentication and ownership checks to the GET, PATCH, and DELETE endpoints for health data by ID. The review feedback highlights a potential mass assignment vulnerability in the PATCH endpoint where the request body is passed directly to the update query, and suggests optimizing the DELETE endpoint by combining the ownership check and deletion into a single deleteMany database operation.