Per-user ownership in a .NET Minimal API (and how the user reaches your endpoint)

How I made products belong to the user who created them in a .NET 10 Minimal API, why the answer is 403 and not 404, and how authentication gets from the Authorization header to your handler.