fix: inject demo userId via Fastify hook, remove Clerk guard from controllers

fix: Critical auth + ownership + container bugs from audit

module 4-8 done, bugs fixed

day 4,5