[DEF-003] ScanImportEndpoints — POST/GET/DELETE /api/dashboard/scans/import* routes have no authorization check

## Summary

`ScanImportEndpoints.cs` maps POST, GET, and DELETE routes under `/scans/import*` without any `.RequireAuthorization()` call. These routes are registered on a separate path from the main dashboard group and are **not** covered by a fix to DEF-001 alone.

## Location

- `src/Ato.Copilot.Mcp/Endpoints/ScanImportEndpoints.cs`
- grep for `RequireAuthorization` in this file → **zero results**

## Severity

**MEDIUM** — Unauthenticated access to scan import operations. Must be fixed independently of DEF-001.

## Steps to Reproduce

\`\`\`bash
curl -X POST https:///api/dashboard/scans/import \
-H "Content-Type: application/json" \
-d '{...}'
# Expected: 401 Unauthorized
# Actual: request processed without authentication
\`\`\`

## Fix Direction

Add `.RequireAuthorization()` to each mapped route in `ScanImportEndpoints.cs`, or register this group under the protected dashboard route group.

## Related

- DEF-001 (#822) — Dashboard group also lacks auth, but is a separate file/registration path

## Evidence Source

- War Machine CRUD inventory `73e2e825caab4903` — ScanImport marked 🔴 known-broken
- Star-Lord QA audit `84b7431961aa4750`
- Banner consolidated findings `539e6ef45fe842b8`

Read src/Ato.Copilot.Mcp/Endpoints/ScanImportEndpoints.cs and locate the POST, GET, and DELETE route mappings under /scans/import*. Check how authorization is applied to those routes; done means unauthenticated requests receive 401, as in the issue's reproduction.

Written by the indexing model from the issue text.