fix(security): clear Bucket-B (ADR-023 + auth/routing)

[rubenvdlinde]

Summary

Clears all Bucket-B security findings for larpingapp as identified by the Hydra gate sweep.

Gate before → after

Gate	Before	After
5 route-auth	FAIL — 1 method missing auth attribute	PASS
6 orphan-auth	PASS	PASS
7 no-admin-idor	PASS*	PASS
9 semantic-auth	PASS	PASS
14 route-reachability	PASS	PASS
17 redundant-controller	PASS	PASS

*Gate 7 was PASS before the fix but would have failed once gate-5 was addressed — adding #[NoAdminRequired] without a body guard triggers it. Both are fixed together.

Changes made

lib/Controller/CharactersController.php

Posture decision: downloadPdf is a user-invokable read+action (character PDF download). Correct posture is #[NoAdminRequired] + null-user 401 guard.

• Added use OCP\AppFramework\Http\Attribute\NoAdminRequired and NoCSRFRequired imports
• Added use OCP\AppFramework\Http; and use OCP\IUserSession; imports
• Added IUserSession $userSession constructor parameter injection
• Added PHP 8 attributes #[NoAdminRequired] and #[NoCSRFRequired] directly before the method signature (within the scanner's 20-line window)
• Added null-user 401 guard at top of downloadPdf body

Route analysis: characters#downloadPdf → GET /characters/{id}/download/{template}. Confirmed no frontend fetch() callers in src/ — this endpoint is called by direct navigation (PDF download link). No routes changed or removed.

tests/unit/Controller/CharactersControllerTest.php

• Added IUserSession mock with default authenticated user to setUp()
• Added testDownloadPdfReturns401WhenNotAuthenticated() test for the new guard path
• Updated all existing test instantiations to pass the 7th constructor argument

ADR-023 kit

Not ported — no requireAction() calls were needed. downloadPdf is a user-scoped read with no privileged action; the null-user 401 guard is the correct and sufficient posture.

Verification

• All 18 Hydra gates: GREEN
• php -l: clean
• composer check:strict: ALL CHECKS PASSED (77 tests, 198 assertions)
• No Vue changes; frontend build not required

Refs #197