Refactor API/service boundaries and modularize frontend

RpgRoller/Api/RequireSessionTokenFilter.cs

@@ -0,0 +1,15 @@
+namespace RpgRoller.Api;
+
+internal sealed class RequireSessionTokenFilter : IEndpointFilter
+{
+    public ValueTask<object?> InvokeAsync(EndpointFilterInvocationContext context, EndpointFilterDelegate next)
+    {
+        if (!context.HttpContext.TryReadSessionTokenFromCookie(out var sessionToken))
+        {
+            return ValueTask.FromResult<object?>(TypedResults.Unauthorized());
+        }
+
+        context.HttpContext.StoreSessionToken(sessionToken);
+        return next(context);
+    }
+}