fix: resolve 9 P0+P1 review findings (bills decorators, campus isolation bypass, ding raw crash, batch import counter, SSE multi-tab, interval leak, dept permissions, cycle prevention, tree depth)

apps/server/src/bills/bills.controller.ts

@@ -27,6 +27,8 @@ import { extractRequestInfo } from '../common/request-utils';
 import { RequirePermission } from '../auth/decorators/permission.decorator';
 import type { Response } from 'express';
 
+@UseGuards(JwtAuthGuard)
+@Controller('bills')
 export class BillsController {
   constructor(
     private service: BillsService,