feat(security): require authentication on every route except login/register

[martinydeAI]

Resume

Description

Right now most routes are reachable anonymously — /, /assistant/{id},
the catalogue, etc. We want the opposite default: every page requires
an authenticated user, and only a short allow-list is reachable without
signing in.

Allow-list (reachable without authentication):

• /login — sign-in form
• /register — anonymous self-signup (feat: anonymous self-signup with email-domain allow-list #62 / feat(registration): anonymous self-signup with email-domain allow-list (#62) #90)
• /register/pending — "thanks, awaiting approval" landing page
• New-password / password-reset pages — once the flow exists; out of
  scope for now beyond reserving a slot.

Everything else (frontpage, catalogue, assistant detail, profile,
admin) is gated behind IS_AUTHENTICATED_FULLY. Anonymous visitors
hitting those routes get the standard 302 to /login with the target
URL preserved so they land back on the page after signing in.

Tasks

• Add an access_control rule in config/packages/security.yaml
  that denies anonymous access by default, with explicit
  allow-list entries for the public routes (/login,
  /register, /register/pending, password-reset pages once
  they land).
• Confirm the firewall's redirect-to-login still preserves the
  target URL (Symfony does this by default; verify).
• Decide what / redirects to for unauthenticated visitors —
  /login or a public landing page outside the app shell.
• Functional test for each public route (still reachable
  anonymously) and at least one gated route (302 to /login).
• CHANGELOG entry under ### Added.

Out of scope

• Implementing the new-password / password-reset flow itself.
  Reserve the route name and add it to the allow-list when that
  PR opens.
• Per-role gating beyond IS_AUTHENTICATED_FULLY — voters and
  ROLE_* checks stay on the controllers that already use them
  (admin user-management, etc.).

---

Details - AI specificities

• Symfony docs:
  https://symfony.com/doc/current/security/access_control.html.
• The existing main firewall in config/packages/security.yaml
  already carries form_login + logout config. The
  access_control block is what we extend.
• Order matters: the allow-list paths (/login, /register*) need
  to match IS_AUTHENTICATED_ANONYMOUSLY (or PUBLIC_ACCESS)
  before the catch-all IS_AUTHENTICATED_FULLY line.
• Don't gate /_wdt, /_profiler, or asset routes (the existing
  dev firewall already excludes them — confirm prod doesn't trip
  on them).
• Tests live under tests/Integration/Controller/ — add a
  dedicated AccessControlTest or extend an existing controller
  test, whichever reads better.