fix: make JwtAuthGuard global to run before PermissionGuard, skip @Public routes

apps/server/src/app.module.ts

@@ -33,6 +33,7 @@ import { AuthModule } from './auth/auth.module';
 import { RbacModule } from './rbac/rbac.module';
 import { StudentsModule } from './students/students.module';
 import { PermissionGuard } from './auth/guards/permission.guard';
+import { JwtAuthGuard } from './auth/guards/jwt-auth.guard';
 import { RoomsModule } from './rooms/rooms.module';
 import { OccupanciesModule } from './occupancies/occupancies.module';
 import { ExpensesModule } from './expenses/expenses.module';
@@ -129,6 +130,7 @@ import { SyncModule } from './sync/sync.module';
   ],
   providers: [
     { provide: APP_GUARD, useClass: ThrottlerGuard },
+    { provide: APP_GUARD, useClass: JwtAuthGuard },
     { provide: APP_GUARD, useClass: PermissionGuard },
   ],
 })