feat(data): support unauthenticated requests and improve documentation

- Update authenticatedUser to be nullable to support unauthenticated requests
- Add comments to explain user ownership and authentication checks
- Refactor user ID determination logic for repository calls

Author: fulleni

routes/api/v1/data/index.dart

@@ -29,7 +29,8 @@ Future<Response> onRequest(RequestContext context) async {
 Future<Response> _handleGet(RequestContext context) async {
   final modelName = context.read<String>();
   final modelConfig = context.read<ModelConfig<dynamic>>();
-  final authenticatedUser = context.read<User>();
+  // Read authenticatedUser as nullable, as per configurable authentication.
+  final authenticatedUser = context.read<User?>();
   final params = context.request.uri.queryParameters;
 
   _logger
@@ -73,8 +74,12 @@ Future<Response> _handleGet(RequestContext context) async {
         )
       : null;
 
-  final userIdForRepoCall =
-      (modelConfig.getOwnerId != null &&
+  // Determine userId for repository call.
+  // If the model is user-owned and the user is authenticated and not an admin,
+  // then the operation should be scoped to the authenticated user's ID.
+  // Otherwise, it's a global operation or an admin bypass.
+  final userIdForRepoCall = (modelConfig.getOwnerId != null &&
+          authenticatedUser != null &&
           !context.read<PermissionService>().isAdmin(authenticatedUser))
       ? authenticatedUser.id
       : null;
@@ -101,7 +106,8 @@ Future<Response> _handleGet(RequestContext context) async {
 Future<Response> _handlePost(RequestContext context) async {
   final modelName = context.read<String>();
   final modelConfig = context.read<ModelConfig<dynamic>>();
-  final authenticatedUser = context.read<User>();
+  // Read authenticatedUser as nullable, as per configurable authentication.
+  final authenticatedUser = context.read<User?>();
 
   _logger.info('Handling POST request for model "$modelName".');
 
@@ -124,8 +130,12 @@ Future<Response> _handlePost(RequestContext context) async {
     );
   }
 
-  final userIdForRepoCall =
-      (modelConfig.getOwnerId != null &&
+  // Determine userId for repository call.
+  // If the model is user-owned and the user is authenticated and not an admin,
+  // then the operation should be scoped to the authenticated user's ID.
+  // Otherwise, it's a global operation or an admin bypass.
+  final userIdForRepoCall = (modelConfig.getOwnerId != null &&
+          authenticatedUser != null &&
           !context.read<PermissionService>().isAdmin(authenticatedUser))
       ? authenticatedUser.id
       : null;