feat: Implement user validation and ownership checks for image, reward, and task APIs

- Added `get_validated_user_id` utility function to validate user authentication across multiple APIs.
- Updated image upload, request, and listing endpoints to ensure user ownership and proper error handling.
- Enhanced reward management endpoints to include user validation and ownership checks.
- Modified task management endpoints to enforce user authentication and ownership verification.
- Updated models to include `user_id` for images, rewards, tasks, and children to track ownership.
- Implemented frontend changes to ensure UI reflects the ownership of tasks and rewards.
- Added a new feature specification to prevent deletion of system tasks and rewards.

backend/api/utils.py

@@ -1,5 +1,7 @@
 import jwt
 import re
+from db.db import users_db
+from tinydb import Query
 from flask import request, current_app, jsonify
 
 from events.sse import send_event_to_user
@@ -24,12 +26,18 @@ def get_current_user_id():
         return None
     try:
         payload = jwt.decode(token, current_app.config['SECRET_KEY'], algorithms=['HS256'])
-        email = payload.get('email')
-        if not email:
+        user_id = payload.get('user_id')
+        if not user_id:
             return None
-        return sanitize_email(email)
+        return user_id
     except jwt.InvalidTokenError:
         return None
+    
+def get_validated_user_id():
+    user_id = get_current_user_id()
+    if not user_id or not users_db.get(Query().id == user_id):
+        return None
+    return user_id    
 
 def send_event_for_current_user(event):
     user_id = get_current_user_id()