fix(security): resolve IDOR vulnerability in public routines endpoint

[Abhishek2005-ard]

Overview

This PR resolves an Insecure Direct Object Reference (IDOR) vulnerability in the getPublicRoutine endpoint. Previously, any routine could be fetched by its ID without authentication, unintentionally exposing private user routines if an ID was guessed or leaked.

Changes Made

• Database Schema: Introduced an isPublic boolean flag (default: false) to the Routine model.
• Backend API:
  • Updated getPublicRoutine to return a 403 Forbidden response for routines that exist but are not explicitly marked as public.
  • Modified updateRoutine to accept and process the new isPublic field.
• Frontend Workflows:
  • The "Copy Share Link" action in RoutineCard.jsx now automatically triggers an API call to set isPublic: true before generating the link.
  • Added a new "Revoke Share Link" option in the routine menu, allowing users to instantly revoke public access and revert the routine to private.

Testing Performed

• Verified that unauthenticated requests to /routines/public/:id for private routines return 403.
• Verified that generating a share link correctly updates the database flag and allows public access.
• Verified that revoking the share link correctly blocks access again.

close #1566