fix: add missing @RequirePermission decorators

Adds @RequirePermission to 19 TS GraphQL resolvers across 5
subgraphs (iam, config-service, core-edu, content, msg) per
audit report §6.1. Maps: iam user/role -> IAM_USER_READ;
config-service 5 queries -> CONFIG_USER; core-edu classInfo ->
CLASS_READ, exam -> EXAM_READ, grade -> GRADE_READ, homework
-> HOMEWORK_READ, datascope visibleGrades/visibleExams ->
GRADE_READ/EXAM_READ; content chapter/knowledgePoint/question/
textbook -> CONTENT_*_READ; msg notifications ->
MSG_NOTIFICATION_READ, template -> MSG_NOTIFICATION_MANAGE.
Federation resolveReference left unguarded. Python subgraphs
(data-ana, ai) deferred to follow-up infrastructure work.

services/config-service/src/graphql/resolvers/user-layout.resolver.ts

@@ -20,6 +20,10 @@ import {
   DataLoaderService,
   type UserLayoutOverrideEntity,
 } from "../dataloader.service.js";
+import {
+  Permissions,
+  RequirePermission,
+} from "../../middleware/permission.guard.js";
 
 @ObjectType()
 @Directive(`@key(fields: "userId")`)
@@ -46,6 +50,7 @@ export class UserLayoutResolver {
   }
 
   @Query(() => UserLayoutOverrideGql, { nullable: true })
+  @RequirePermission(Permissions.CONFIG_USER)
   async userLayoutOverride(
     @Args("userId", { type: () => ID }) userId: string,
   ): Promise<UserLayoutOverrideEntity | null> {