fix: add auth checks to financial routes (hibah, sadaqah, waqf, zakat)

Critical security fix: 5 financial POST endpoints were missing
authentication checks. Added requireAuth() middleware to:
- /api/flh/hibah/send
- /api/flh/hibah/accept
- /api/flh/sadaqah/send
- /api/flh/waqf/contribute
- /api/flh/zakat/pay

These involve FLH token transfers and must verify user identity.

src/app/api/flh/zakat/pay/route.ts

@@ -1,31 +1,21 @@
-import { NextRequest, NextResponse } from "next/server";
+import { NextRequest, NextResponse } from next/server;
+import { requireAuth } from @/lib/auth;
 
 const COMMUNITY_URL = process.env.COMMUNITY_URL || process.env.UMMAHID_URL || "http://ummahid:3000";
 
 export async function POST(req: NextRequest) {
-  const authHeader = req.headers.get("authorization");
-  if (!authHeader) {
-    return NextResponse.json({ error: "Authorization required" }, { status: 401 });
+  const jwtPayload = await requireAuth(req);
+  if (!jwtPayload) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
   }
 
+  const auth = req.headers.get("authorization");
+  if (!auth) return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
   try {
     const body = await req.json();
-    const ummahRes = await fetch(`${COMMUNITY_URL}/api/v2/zakat/pay`, {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/json",
-        Authorization: authHeader,
-      },
-      body: JSON.stringify(body),
+    const r = await fetch(`${COMMUNITY_URL}/api/v2/zakat/pay`, {
+      method: "POST", headers: {"Content-Type":"application/json",Authorization:auth}, body: JSON.stringify(body)
     });
-
-    const data = await ummahRes.json();
-    return NextResponse.json(data, { status: ummahRes.status });
-  } catch (error) {
-    console.error("[zakat-pay] Proxy error:", error);
-    return NextResponse.json(
-      { error: "Failed to process zakat payment" },
-      { status: 502 }
-    );
-  }
+    return NextResponse.json(await r.json(), { status: r.status });
+  } catch (e) { return NextResponse.json({ error:"Failed" }, { status:502 }); }
 }