fix: apply showMemberMiddleware to flowsheet write routes

[jakebromberg]

Summary

• Bug: showMemberMiddleware was imported in apps/backend/app.ts but never applied to any route, allowing any authenticated DJ to modify flowsheet entries even without joining the active show.
• Fix: Applied showMemberMiddleware after requirePermissions on the POST, PATCH, and DELETE flowsheet routes in flowsheet.route.ts. Removed the unused import from app.ts.
• Hardening: Added try/catch error handling to the middleware (previously had none) and simplified the DJ lookup from .filter().length to .some().

Test plan

• Unit tests for showMemberMiddleware covering:
  • DJ not in show → returns 400
  • DJ in show → calls next()
  • No DJs in show → returns 400
  • DB error → returns 500 (new error handling)
• Full unit test suite passes (124 tests, 9 suites)

Fixes #10

Made with Cursor