feat(templates): add JWT token to User struct for server-side WebSocket authentication

- Add Token field to templates.User struct for passing JWT to frontend
- Modify getTemplateUserWithTheme() to extract token from HttpOnly cookie
- Inject server-side token into templates for WebSocket connections

This change enables templates to access the authentication token directly
from the server, allowing WebSocket URLs to be constructed with the token
already included. This eliminates the need for client-side localStorage
token management and provides a more secure SSR-native approach.

The token is extracted from the existing HttpOnly cookie that JWT middleware
validates, ensuring no additional security surface is introduced.

internal/router/helpers.go

@@ -35,12 +35,19 @@ func getTemplateUserWithTheme(c *echo.Context, cfg *Config) (templates.User, err
 		userTheme = userDB.Theme.String
 	}
 
+	// Extract JWT token for WebSocket authentication
+	token := ""
+	if cookie, err := c.Cookie("token"); err == nil {
+		token = cookie.Value
+	}
+
 	return templates.User{
 		ID:       userID,
 		Email:    userEmail,
 		Username: userUsername,
 		Role:     userRole,
 		Theme:    userTheme,
+		Token:    token,
 	}, nil
 }
 

templates/types.go

@@ -15,6 +15,7 @@ type User struct {
 	FirstName string
 	LastName  string
 	CreatedAt time.Time
+	Token     string
 }
 
 type PageData struct {