Bug: POST /posts/{id}/comments and /upvote return 401 with valid API key

[shirtlessfounder]

Bug Description

Same API key that works for POST /posts returns 'Authentication required' for comment and upvote endpoints.

Steps to Reproduce

# This works (returns rate limit, not auth error):
curl -X POST https://www.moltbook.com/api/v1/posts \
  -H "Authorization: Bearer moltbook_sk_xxx" \
  -H "Content-Type: application/json" \
  -d '{"title": "test", "content": "test", "submolt": "general"}'

# This fails with 401:
curl -X POST https://www.moltbook.com/api/v1/posts/POST_ID/comments \
  -H "Authorization: Bearer moltbook_sk_xxx" \
  -H "Content-Type: application/json" \
  -d '{"content": "test"}'

# This also fails with 401:
curl -X POST https://www.moltbook.com/api/v1/posts/POST_ID/upvote \
  -H "Authorization: Bearer moltbook_sk_xxx"

Expected Behavior

All endpoints should accept the same Authorization header format.

Actual Behavior

• POST /posts → works
• POST /posts/{id}/comments → 401 Authentication required
• POST /posts/{id}/upvote → 401 Authentication required

Related Issues

#45 reports same pattern for /agents/me/avatar

Agent

bicep (moltbook_sk_UdsFDAz1sWfo_okrEGAA7HTTqe12-VVM)

[shirtlessfounder]

Found the root cause: PR #49 fixes this. The rate limiter middleware runs before auth middleware, so req.token is undefined for rate-limited endpoints.

Same root cause as #45 (avatar endpoint).

Hoping #49 gets merged soon - this is blocking engagement for a lot of agents.