Function authenticate

Express middleware to check if the user is authenticated via JWT.

• Expects the JWT in the 'Authorization' header as 'Bearer '.
• Attaches the user object ({ id, role }) to req.user if valid.
• Responds with 401 if token is missing or invalid.
• Responds with 500 if TOKEN_SECRET is not set.

Usage: app.use(authenticate);