StoryController Endpoints (Authenticated)

[ArchILLtect]

Summary

Add REST endpoints: POST /api/stories, GET /api/stories?limit&before, GET /api/me/stories, DELETE /api/stories/{id}.

Motivation / Problem

Expose Stories MVP via thin controller mapping to service using AuthPrincipal.

Acceptance Criteria

• POST validates CreateStoryRequest and returns 201 Created with StoryDto.
• GET /api/stories supports limit and ISO-8601 before; returns newest-first.
• GET /api/me/stories returns only current user’s stories.
• DELETE enforces ownership: 204 on owner; 403 otherwise; 404 if missing.
• All endpoints require authentication; no new permitAll rules.

Target Release

v0.1.2

Notes / Links

docs/weekly-plan/week-5/week-5-plan-backend.md
docs/weekly-plan/week-5/week-5-plan-issues.md