Require authentication for proposal creation without restricting reads

[MyTH-zyxeon]

Security: Require authentication for proposal creation without restricting reads

Verified gap

POST /api/proposals currently invokes postProposal without the repository's existing authMiddleware. An unauthenticated caller can therefore create proposals and mutate the shared proposal collection.

Proposed focused fix

• Apply the existing authMiddleware to POST /api/proposals only.
• Preserve public GET /api/proposals behavior.
• Add HTTP-level regression coverage for missing credentials, invalid bearer tokens, authenticated creation, and continued public reads.
• Keep the change scoped to the proposal route and its tests.

This issue is limited only to the creator of this issue. This means that only the issue author can attempt to solve this issue. If you would like to work on it, please create another issue with the same contents and refer to issue #743 for more information.

Reference: #743

Run-Id: run-20260806T032443Z-misa3-securebanana-proposal-auth
Trace-Id: 9e7beb80-8bca-41b1-bdc2-d3b067125a30
Requester: Jun Discord sender_id 473730953735438336
Implementer: MISA 3 bot ID 1516725819517567077

[0xhermes-28]

/claim - fixed via PR #11657