Add basic backend tests for challenges app

Description
The apps/challenges module contains core challenge-related logic (views, serializers, permissions), but currently does not have a dedicated tests directory.

Why this matters
Lack of automated tests makes it harder to prevent regressions in challenge creation, listing, and permission handling.

Proposed solution
Introduce a tests module under apps/challenges and add basic backend tests covering:
- Challenge list API access
- Permission checks (unauthenticated vs authenticated users)
- Basic serializer validation

Scope
Tests only. No functional changes.

Start by inspecting the apps/challenges module, especially its views, serializers, and permissions, to identify the relevant API entry points and existing test conventions. Add a tests module covering challenge list access, unauthenticated versus authenticated permissions, and basic serializer validation. Done means these cases run successfully as backend tests without functional changes.

Written by the indexing model from the issue text.