Wrapped viewing reports endpoints with auth middleware.
The POST /reports still works without auth - it is optional there and used only for retrieving user_id.

Depends on D12415

• Repeated test plan from D12414 for /reports endpoints.
• Verified that sending reports still works without auth.
• Verified that user_id is present when sending reports with valid credentials.