BUG: [Security] Inconsistent authentication on backend routes

### Is there an existing issue for this?

- [x] I have searched the existing issues

### What happened?

🌟 Feature Description
I propose we standardize the usage of the @require_auth decorator across all our backend routes. Right now, it looks like only some files are checking if a user is logged in, while others are completely open.

🔍 Problem Statement
While digging through the route files, I noticed a pretty big inconsistency:

Protected: medicine.py correctly uses @require_auth to block access if you aren't logged in.

Exposed: weight.py, symptoms.py, discharge.py, and profile.py don't seem to use the decorator at all.

This implies that if session auth is active, these endpoints might be accessible to anyone (even without a login), which is a security risk for user data.

🎯 Expected Outcome
Security: All endpoints that touch sensitive data (Weight, Symptoms, Profile) must require a valid session.

Consistency: Every route file should follow the same pattern (importing and applying require_auth).

### Record

- [x] I agree to follow this project's Code of Conduct
- [x] I want to work on this issue