fix(api): secure request workflows against identity impersonation

[patrickschiller]

Motivation

• The requests and employees endpoints trusted caller-supplied employeeId/actorId and lacked authentication, allowing unauthenticated enumeration and privileged-actor impersonation.
• The change's intent is to require authentication for request workflows and to derive the requester/actor identity from the authenticated JWT principal instead of request body fields.
• The fix aims to close this high-impact authorization gap with minimal, localized changes that preserve the existing workflow semantics for authenticated users.

Description

• Apply @ApiBearerAuth() and @UseGuards(JwtAuthGuard) to RequestsController and protect the employee directory by adding JwtAuthGuard to EmployeesController.
• Stop trusting CreateRequestDto.employeeId and TransitionDto.actorId by deriving the acting employee from the @CurrentUser() JWT principal in every requests controller handler and forwarding that authenticated user.id to the service.
• Harden RequestsService by adding object-level visibility and authorization helpers (visibilityWhere, assertCanView, and assertApprover) and enforcing that managers may only act on requests assigned to them while HRAdmin retains org-wide visibility.
• Regenerate the OpenAPI spec so protected endpoints advertise bearer authentication requirements and update checked-in apps/api/openapi.json / generated client accordingly.
• Keep existing functionality for approved flows (including materializeTimeAdjustment) while ensuring all transitions require a bound authenticated principal.

Testing

• Ran type checking with pnpm nx run api:typecheck which completed successfully.
• Built the API with pnpm nx run api:build which completed successfully.
• Ran lints with pnpm nx run api:lint which completed successfully and reported only pre-existing warnings (6 warnings).
• Regenerated OpenAPI and client with pnpm generate:api and ran pnpm nx format:check for the modified files, both of which completed successfully.
• Committed the changes as fix(api): secure request workflows (DCO-signed); an attempt to emit PR metadata via the local make_pr helper failed due to an environment module mismatch but does not affect the code changes or the automated checks above.

---

Codex Task