fix(api): secure request workflow identities

[patrickschiller]

Motivation

• Close a critical impersonation vulnerability where unauthenticated callers could set employeeId/actorId in request bodies and perform privileged transitions (approvals, HR confirms) that materialize payroll-relevant TimeEntries.
• Ensure request and employee-directory endpoints require bearer authentication and that all request transitions and reads are bound to the authenticated principal, not caller-supplied UUIDs.

Description

• Require JWT authentication for the requests and employees controllers by adding class-level @ApiBearerAuth() and @UseGuards(JwtAuthGuard), and derive actor identity from @CurrentUser() rather than request body fields.
• Bind new/creation endpoints to the authenticated user by overriding incoming employeeId with user.id when creating requests.
• Replace loose role-only checks with object-scoped authorization in RequestsService: add assertApprover(request, actorId), visibilityWhere(actorId), and assertCanView(request, actorId) to enforce that Managers may only transition assigned requests, substitutes may act only for their assigned requests, requesters may cancel their own requests, and HR admins retain org-wide visibility.
• Harden listing/get-by-id/events paths to only return rows visible to the caller by adding an actorId argument to list/getById/events and applying visibilityWhere.
• Keep HR/approver role checks for HR-confirm/-reject paths while preventing attacker-supplied actor impersonation.
• Regenerate the checked-in OpenAPI (apps/api/openapi.json) to declare bearer security on the protected routes.

Testing

• Ran type-check and build targets: pnpm nx run api:typecheck and pnpm nx run api:build, both succeeded.
• Ran lint and OpenAPI generation: pnpm nx run api:lint completed with pre-existing warnings and no errors, and pnpm generate:api regenerated apps/api/openapi.json successfully.
• Ran pnpm nx run api-e2e:typecheck which succeeded, while pnpm nx run api-e2e:e2e could not complete because the test global setup could not connect to a local PostgreSQL instance, so full e2e execution was not possible in this environment.

---

Codex Task