fix: extract softAuth to shared module and apply to icon_sets router

Move the softAuth middleware from devices.js into a new shared
lib/api/soft_auth.js module. Apply router.use(softAuth) and
router.use(errorMiddleware) to icon_sets.js so that POST/DELETE
owner-only routes return 401 (not 500) when no auth is present.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

lib/api/routes/icon_sets.js

@@ -2,11 +2,13 @@
 import { Router } from 'express';
 import multer from 'multer';
 import { requireOwner } from '../cap.js';
-import { asyncWrap } from '../errors.js';
+import { asyncWrap, errorMiddleware } from '../errors.js';
+import { softAuth } from '../soft_auth.js';
 import * as sets from '../../icons/sets.js';
 import { processFile, unpackZip, fetchUrl, isZip } from '../../icons/ingest.js';
 
 export const router = Router();
+router.use(softAuth);
 const upload = multer({ storage: multer.memoryStorage(), limits: { fileSize: 6 * 1024 * 1024, files: 50 } });
 
 // GET /api/icon-sets — list sets + their icons (open; <img> can't send bearer).
@@ -49,3 +51,5 @@ router.delete('/:set', requireOwner, asyncWrap(async (req, res) => {
   catch (e) { return res.status(e.message === 'reserved_set' ? 409 : 400).json({ error: { code: e.message } }); }
   res.json({ ok: true });
 }));
+
+router.use(errorMiddleware);