JWT Authentication: I Locked Myself Out of My Own API and Learned How Tokens Work

I built my first Express API and felt good about it. Routes worked, data came back, everything looked right. Then a friend asked "so how do you stop random people from deleting stuff?" and I realized