fix(api): add WorkspaceGuard to controllers and fix route ordering

apps/api/src/auth/auth.controller.ts

@@ -8,28 +8,6 @@ import { CurrentUser } from "./decorators/current-user.decorator";
 export class AuthController {
   constructor(private readonly authService: AuthService) {}
 
-  /**
-   * Handle all BetterAuth routes
-   * BetterAuth provides built-in handlers for:
-   * - /auth/sign-in
-   * - /auth/sign-up
-   * - /auth/sign-out
-   * - /auth/callback/authentik
-   * - /auth/session
-   * etc.
-   *
-   * Note: BetterAuth expects a Fetch API-compatible Request object.
-   * NestJS converts the incoming Express request to be compatible at runtime.
-   */
-  @All("*")
-  async handleAuth(@Req() req: Request) {
-    const auth = this.authService.getAuth();
-    return auth.handler(req);
-  }
-
-  /**
-   * Get current user profile (protected route example)
-   */
   @Get("profile")
   @UseGuards(AuthGuard)
   getProfile(@CurrentUser() user: AuthUser) {
@@ -39,4 +17,10 @@ export class AuthController {
       name: user.name,
     };
   }
+
+  @All("*")
+  async handleAuth(@Req() req: Request) {
+    const auth = this.authService.getAuth();
+    return auth.handler(req);
+  }
 }