Authorize before the expensive work starts

Authorization belongs at the front of the request, not after you have already done the hard part. Common pattern: generate a big export, render a PDF, fan out to workers, or query a warehouse — then c