fix: restore the authorization decorators three new routes displaced

Inserting the new PATCH handlers directly above an existing route put them
between that route's @RequirePermission decorator and its method, so the
decorator bound to the new handler instead:

- DELETE /documents/:id lost documents:delete
- POST /honey-batches/:id/measurements lost honey-batches:measure
- POST /queens/:id/evaluations lost queens:evaluate

and each new PATCH ended up carrying two @RequirePermission decorators, of
which only one takes effect.

This did not open anything up. PermissionsGuard fails closed by decorator
absence: a non-public route with neither @RequirePermission nor
@AnyAuthenticatedUser is denied outright, so the three routes would have
returned 403 for every caller including an administrator. The effect was a
broken endpoint, not a bypass.

Each decorator is back on the route it belongs to, and the duplicates are
gone. test/authorization-coverage.e2e-spec.ts asserts exactly this contract
across every route and is the check that should run before a route change
ships.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

ApiCore-Backend/src/honey-batches/honey-batches.controller.ts

@@ -117,7 +117,6 @@ export class HoneyBatchesController {
     return this.honeyBatchesService.update(id, dto, actor.id);
   }
 
-  @RequirePermission('honey-batches:measure')
   @RequirePermission('honey-batches:measure')
   @Patch('measurements/:measurementId')
   updateMeasurement(
@@ -132,6 +131,7 @@ export class HoneyBatchesController {
     );
   }
 
+  @RequirePermission('honey-batches:measure')
   @Post(':id/measurements')
   addMeasurement(
     @Param('id') id: string,