Turn protection from opt-in into default-deny

Nothing in src/nest/** was an APP_GUARD. Every protected route said so
itself, 62 times, which means a forgotten @UseGuards was a silent bypass
rather than an error. GlobalAuthGuard inverts that: a route is authenticated
unless it carries @Public() or @OptionalAuth(), or declares its own guard
chain.

Reading the declared chain is what makes this behaviour-neutral. Nest runs
global guards before route guards, so without that check the global guard
would 401 an anonymous request to an addon-gated controller before its
AddonGuard could answer 404 - inverting an order four e2e suites pin, and
leaking which addons are installed. A controller that declared a chain keeps
deciding for itself.

It is a new class rather than JwtAuthGuard gaining a Reflector: that guard is
constructed positionally in its own test with a context stub that has no
getHandler, and the two want opposite behaviour anyway.

@Public() takes a required reason, and the reasons are the diff worth
reading: the invite token IS the credential, help assets are loaded by <img>
which cannot send one, logout has to work with an expired session or nobody
can sign out.

The real deliverable is the inventory. validateRouteGuards runs in buildApp
next to the body-contract gate and refuses to start when a route answers
anonymously without being on a reviewed list of 25 - or when a listed one no
longer does. An allow list nobody prunes stops being a list.

Default-deny found two controllers on its own: SharedController and
OidcController both sit in a file next to a guarded controller, so a
file-level search for unguarded ones missed them. 37 tests went red and named
them. That is the mechanism working before the change shipped, not after.

server/src/bootstrap.ts

@@ -11,6 +11,7 @@ import { setupApiDocs } from './nest/platform/api-docs';
 import { McpRegistryService } from '@trek/nest-mcp';
 import { setMcpRegistry } from './mcp/registry-handoff';
 import { validateBodyContracts } from './nest/common/validate-body-contracts';
+import { validateRouteGuards } from './nest/common/validate-route-guards';
 
 /**
  * Builds the unified TREK NestJS application that serves the ENTIRE surface — the
@@ -66,5 +67,9 @@ export async function buildApp(): Promise<INestApplication> {
   // must carry a createZodDto class (validated by the global ZodValidationPipe)
   // or sit on the ratchet-only legacy allow-list — otherwise refuse to boot.
   validateBodyContracts(app);
+  // Fail closed on the anonymous surface too: a route that answers without a
+  // session must carry @Public() with a reason AND be on the reviewed list.
+  // Default-deny protects what exists; this is what keeps the exemptions honest.
+  validateRouteGuards(app);
   return app;
 }