Replaces six non-null assertions on req.user with the requireUser helper from auth.ts, which throws a descriptive error if the auth hook didn't populate req.user. Adds an inline comment in /api/ws/user explaining the manual auth check is defensive (the global hook already enforces auth). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>