refactor best book award in prep for fastapi

[RayBB]

No description provided.

[RayBB]

AI review:

Summary: Refactors the best book award POST handler to extract logic into a static method for future FastAPI migration.
Changes:

1. Moves user authentication earlier in the request lifecycle
2. Extracts core logic to process_bestbook_award() static method
3. Returns dicts instead of json.dumps() (caller handles serialization)
   Risks: Minimal
   The refactoring is safe. The authentication logic is preserved - if user is None, username becomes None, and the code correctly returns "Authentication failed". The change to pass username as a parameter instead of fetching it inside the method is a reasonable step toward making the code testable and usable in FastAPI.