6. Add the route auth policy

backend/src/common/route-auth.spec.ts states every route's auth posture once, in a POLICY table, so an unguarded route fails loudly instead of silently shipping open. A controller with no entry there fails that suite, whether or not its own guards are correct - this step is required, not optional cleanup.

Add an entry to POLICY, keyed by the controller's class name, matching the guards each route actually carries. The spec finds every controller Nest registers by walking AppModule's imports, so there is nothing to import and no other list to update:

// backend/src/common/route-auth.spec.ts, inside POLICY, alongside the other entries:
TasksController: {
  routes: {
    list: SESSION,
    create: SESSION,
    update: SESSION,
    delete: SESSION,
  },
},

Run npm run test:jest -- src/common/route-auth.spec.ts to check just this before moving on.