nestjs-core / access-control: optional boot-time check for unguarded routes

### Use case

Authentication and access control are applied per controller and per handler (`@AuthPublic`, `@AccessControlReadMany`, query services). A new endpoint that forgets its grant decorator, or is marked public by mistake, ships without any warning. Nothing at application start tells you a route is unguarded.

### Proposal

An opt-in route audit that runs at `onApplicationBootstrap`, scans every registered controller and **throws at boot** (or logs, in report mode) when a route violates a declared policy:

- `requireAuth`: every route is authenticated unless explicitly public.
- `requireAcl`: every authenticated route has an access-control grant decorator.
- `requireAclQuery`: routes on resources that need row checks declare a query service.
- `allow`: an explicit, reviewed list of exemptions.
- Always-on checks worth considering: a schema parameter without a validation pipe, an open passthrough response schema.

This turns "someone forgot the guard" from a code-review hope into a failed boot and a failed CI run.

Prior art: Rockets `RouteAuditService` with `routePolicy` in `packages/rockets-core/src/infrastructure/audit/route-audit.service.ts` and `evaluate-route-policy.ts`, covered by `rockets-core-route-audit.e2e-spec.ts`.

Start by reading Rockets' packages/rockets-core/src/infrastructure/audit/route-audit.service.ts and evaluate-route-policy.ts, then review rockets-core-route-audit.e2e-spec.ts. Use them to scope an opt-in NestJS boot-time route audit, with enforcement and report modes, and define tests showing that policy violations fail boot or are reported while explicit exemptions pass.

Written by the indexing model from the issue text.