Problem

In apps/backend/src/routes/public.ts, when an authenticated owner views their own profile, viewerId was left as null (not set to their id). The guard if (viewerId !== user.id) then evaluates null !== user.id which is always true, so the self-view was
recorded in cardView anyway. This silently inflated totalViews and uniqueViewers on the analytics dashboard.

Fix

Introduced an explicit isSelfView boolean flag in both the /:username and /:username/card/:cardId handlers. When the decoded JWT id matches user.id, isSelfView is set to true and viewerId stays null. The guard is changed from viewerId !== user.id to !isSelfView, which correctly blocks the insert for authenticated owners while still tracking unauthenticated views with viewerId: null.

Affected handlers

• GET /:username
• GET /:username/card/:cardId

Testing

• Authenticated owner viewing own profile → cardView.create NOT called
• Authenticated other user viewing profile → cardView.create called with their id
• Unauthenticated request → cardView.create called with viewerId: null

Closes #203