BUG: Student restriction JWT failure is logged as an unhandled exception

**Describe the Bug**

A `GET /api/students/restriction` request fails JWT authentication with a 401 response and is emitted by `AppAllExceptionsFilter` as an unhandled error.

**Expected Behaviour**

Authentication failures are handled as expected client responses and do not generate misleading unhandled-exception error logs.

**Actual Behaviour**

The API returns 401 and records `UnauthorizedException: Unauthorized` as an unhandled exception.

**Log**

```text
[Nest] 18 - 09/04/2026, 6:31:33 AM LOG [AccessLoggerMiddleware] Request - GET /api/students/restriction From [redacted] | User GUID: [redacted] | User Agent: Safari on macOS
[Nest] 18 - 09/04/2026, 6:31:33 AM ERROR [AppAllExceptionsFilter] Unhandled exception, request path: /api/students/restriction
{
"stack": "UnauthorizedException: Unauthorized\n at JwtAuthGuard.handleRequest (/app/node_modules/@nestjs/passport/dist/auth.guard.js:60:30)",
"response": { "message": "Unauthorized" },
"status": 401,
"message": "Unauthorized",
"name": "UnauthorizedException"
}
```

Start by tracing the GET /api/students/restriction request through JwtAuthGuard and AppAllExceptionsFilter, using the logged UnauthorizedException as the reproduction case. Determine why this expected 401 is classified as unhandled, then verify that authentication failures still return 401 without misleading unhandled-exception error logs.

Written by the indexing model from the issue text.