No hardcoded user IDs in handler logic

Hardcoded user IDs in handlers mean the application is operating as a single-user system dressed up as multi-user software. Every POST, PATCH, or DELETE runs against the demo account's data regardless of which user is authenticated — or whether anyone is authenticated at all. This violates OWASP A01:2021 (Broken Access Control) and CWE-284 (Improper Access Control): the authorization decision has been reduced to a constant. Real users create data they cannot see, and the demo user accumulates all writes silently.

Pull userId from the authenticated session, not a constant. In every API handler that touches user-scoped data, replace the hardcoded ID with a session lookup:

// Remove this pattern:
const userId = 'demo-user-id'

// Replace with:
import { auth } from '@/lib/auth'

export async function POST(req: Request) {
  const session = await auth()
  if (!session?.user?.id) {
    return Response.json({ error: 'Unauthorized' }, { status: 401 })
  }
  const userId = session.user.id
  // proceed with real userId
}

Search src/app/api/ for string literals matching UUID patterns starting with 0000, 1111, or the literal strings demo-user-id, test-user-1, user-1, and replace every occurrence.