Security P2 — Close unauthenticated routes: practice, nudges, jobs (+WS)

[franciszver]

Part of #59.

Part of the broken-access-control remediation epic. Depends on Phase 1. Highest severity — these routes require no authentication at all today.

Findings addressed

• Potential fix for code scanning alert no. 8: Information exposure through an exception #2 practice.py (:112 assign, :426 complete, :539 summary) — all use get_current_user_optional; current_user is never read. Unauthenticated callers can create assignments for any student_id, mutate any student's Elo/completion via item_id, and read any student's performance.
• Potential fix for code scanning alert no. 7: Information exposure through an exception #3 nudges.py (:37 check, :126 users/{user_id}, :298 engage) — same optional-auth pattern; also triggers emails to arbitrary users.
• Phase 0: local baseline — green pytest with no DB/creds, AI mock, local dev docs #9 jobs.py (:27 GET, :62 WebSocket) — GET has unused optional auth; the WebSocket has no auth dependency at all and streams another student's result.

Work

• Switch these handlers from get_current_user_optional to mandatory get_current_user.
• Apply the Phase‑1 helper against the resolved DB user for each student_id/item_id/nudge_id.
• For jobs.py: record owner (Job.user_id/student_id already exist) and check it; authenticate the WS on connect (token via query param or subprotocol) before streaming.

Definition of Done

• All routes reject unauthenticated requests (401).
• Cross-user access returns 403 (Phase‑1 tests green for these routes).
• WS closes unauthenticated/unauthorized connections before sending any data.

Affected files

src/api/handlers/practice.py, src/api/handlers/nudges.py, src/api/handlers/jobs.py, src/api/middleware/auth.py

[franciszver]

Done and merged to main in PR #66 (part of epic #59).