fix: add authentication to POST /schedule endpoint

[jakebromberg]

Summary

• Bug: POST /schedule had no authentication middleware, allowing anonymous users to insert arbitrary schedule entries
• Fix: Added requirePermissions({ flowsheet: ['write'] }) middleware to the POST route, matching the pattern used by flowsheet and other write endpoints
• Test: Added unit test verifying POST /schedule returns 401 without auth and GET /schedule remains publicly accessible
• Infrastructure: Added @wxyc/authentication mock and schedule/NewShift exports to the database mock for unit testing routes that use auth middleware

Test plan

• New unit test fails before fix (POST returns 200)
• New unit test passes after fix (POST returns 401)
• All 122 existing unit tests continue to pass
• Integration test: POST /schedule without auth header returns 401
• Integration test: POST /schedule with valid DJ+ token succeeds

Made with Cursor