fix: restore the authorization decorators three new routes displaced

Inserting the new PATCH handlers directly above an existing route put them
between that route's @RequirePermission decorator and its method, so the
decorator bound to the new handler instead:

- DELETE /documents/:id lost documents:delete
- POST /honey-batches/:id/measurements lost honey-batches:measure
- POST /queens/:id/evaluations lost queens:evaluate

and each new PATCH ended up carrying two @RequirePermission decorators, of
which only one takes effect.

This did not open anything up. PermissionsGuard fails closed by decorator
absence: a non-public route with neither @RequirePermission nor
@AnyAuthenticatedUser is denied outright, so the three routes would have
returned 403 for every caller including an administrator. The effect was a
broken endpoint, not a bypass.

Each decorator is back on the route it belongs to, and the duplicates are
gone. test/authorization-coverage.e2e-spec.ts asserts exactly this contract
across every route and is the check that should run before a route change
ships.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

ApiCore-Backend/src/documents/documents.controller.ts

@@ -106,7 +106,6 @@ export class DocumentsController {
     res.send(buffer);
   }
 
-  @RequirePermission('documents:delete')
   @RequirePermission('documents:update')
   @Patch(':id')
   update(
@@ -117,6 +116,7 @@ export class DocumentsController {
     return this.documentsService.update(id, dto, actor.id);
   }
 
+  @RequirePermission('documents:delete')
   @Delete(':id')
   @HttpCode(204)
   delete(@Param('id') id: string, @CurrentUser() actor: AuthenticatedUser) {