feat: add authentication and role guard to scoring SSE stream endpoint

[devin-ai-integration]

Summary

Adds requireAuth middleware and a new requireScorer role guard to the scoring SSE stream endpoint (GET /:eventCode/scoring/stream).

Previously this endpoint had no authentication or authorization, unlike the inspection stream which uses requireAuth + requireInspector.

Changes:

• guards.ts: Added requireScorer guard allowing ADMIN, TSO, HEAD_REFEREE, and REFEREE roles (the roles involved in scoring operations).
• scoring.routes.ts: Applied requireAuth middleware and requireScorer via getEventCodeWithGuard(), matching the pattern used by the inspection stream.

Review & Testing Checklist for Human

• Verify that the allowed roles (ADMIN, TSO, HEAD_REFEREE, REFEREE) cover all users who need scoring stream access in your deployment
• Confirm the display page still works — it uses useScoringRealtime(eventCode, token) and will need a token with one of the allowed roles
• Test that unauthenticated requests to /api/events/:eventCode/scoring/stream return 401
• Test that authenticated users without a scorer role receive 403

Notes

• The display stream endpoint (/:eventCode/display/stream) and match-control stream endpoint (/:eventCode/match-control/stream) also lack auth — these may need similar treatment depending on your requirements.

Link to Devin session: https://app.devin.ai/sessions/2f3a878b48254d9c906c9c6100fefc13
Requested by: @khanhthanhdev

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring