phpcbf auto-fixes: string concatenation spacing, single-line class braces, closing brace placement.
Green phase: PSR-15 AuthMiddleware checks auth_token cookie, looks up session, validates expiry, sets user attribute on request or returns 401.