Routes run authenticated, and the doc says how to read the caller

[czpython]

Every extension router mounts behind the loader's identity gate — a Bearer PAT or the signed-in session — but writing-an-extension.md never said so, and its own OAuth example passes an account_id the author has no documented way to obtain.

druks.accounts now exports current_account_id, so the read comes from a concern namespace instead of the internal druks.accounts.context:

from druks.accounts import current_account_id

@router.get("/reviews")
def list_reviews() -> list[ReviewResponse]:
    return Review.list_for_account(current_account_id.get())

The routes section states the gate and shows the read; the OAuth section names the caller's three doors — self.account_id in a run body, current_account_id.get() in a route, the handler's argument in a subscriber — and the stable-imports table carries the new namespace.