[DEF-001] Dashboard MCP API — all /api/dashboard/* routes publicly accessible (no RequireAuthorization)

## Summary

Every `/api/dashboard/*` CRUD route (~15 entities) is publicly readable and writable because the dashboard route group has no `.RequireAuthorization()` call and `Program.cs` registers only named policies with no `FallbackPolicy`.

## Location

- `src/Ato.Copilot.Mcp/Endpoints/DashboardEndpoints.cs` lines 38–63
- `app.MapGroup("/api/dashboard").WithTags("Dashboard")` — no `.RequireAuthorization()` chained
- `Program.cs` — `AddAuthorization` registers named policies only; no `FallbackPolicy` set
- grep of `Endpoints/Dashboard/` for `RequireAuthorization|AllowAnonymous` → **zero hits**

## Severity

**CRITICAL** — Unauthenticated actors can read and write all dashboard CRUD data.

## Steps to Reproduce

\`\`\`bash
curl -X GET https:///api/dashboard/systems
# Expected: 401 Unauthorized
# Actual: 200 OK with data (no auth header required)
\`\`\`

## Fix Direction

1. Chain `.RequireAuthorization()` on `app.MapGroup("/api/dashboard")` in `DashboardEndpoints.cs`
2. Or set a `FallbackPolicy` in `Program.cs` `AddAuthorization()` to require authentication globally

## Compliance Impact

Violates FedRAMP AC-2, AC-3, IA-2. Blocks ATO authorization.

## Evidence Source

- War Machine CRUD inventory artifact `73e2e825caab4903` (crud-inv.md)
- Star-Lord QA audit artifact `84b7431961aa4750`
- Banner consolidated findings `539e6ef45fe842b8`

Start in src/Ato.Copilot.Mcp/Endpoints/DashboardEndpoints.cs at the /api/dashboard route group, then inspect Program.cs AddAuthorization configuration. Reproduce the issue with the curl request for /api/dashboard/systems and verify that unauthenticated dashboard CRUD requests return 401 instead of 200; check the dashboard endpoint files for authorization or anonymous overrides.

Written by the indexing model from the issue text.