feat(security): check role markers on services

Every service method a controller calls carries @RequiresRole or @Public, checked by a method interceptor and by ArchUnit. deleteByAdmin needs PLATFORM_ADMIN; the Steam callback's linkVerifiedSteamId stays unmarked.

readme.md

@@ -42,7 +42,14 @@ To Be Played is split into three repositories:
   SQL). The access token carries the active role in the `role` claim. **View as**: an admin switches the own login
   down to USER or AUDITOR and back (`POST /api/auth/view-as`); the choice is stored per login in
   `refresh_tokens.active_role` and never goes above the stored role, so a demoted admin loses the rights at the next
-  refresh. Core does not check roles yet.
+  refresh. Core checks the same claim.
+- **Role markers on services**: every service method a controller calls carries `@RequiresRole(Role.X)` or
+  `@Public`, on the method or on its class (the method wins). A Spring Security method interceptor checks the
+  active role while a request is served (scheduled jobs and `@Async` work run without a user and are not checked);
+  a denied call answers `401` without a login, else `403`. `@Public` skips only the role check: login, refresh,
+  "view as" and the Steam callback prove the caller themselves. The URL rules in `SecurityConfig` stay as the outer
+  guard. ArchUnit fails the build for an unmarked method, two markers, a controller calling an `@Async` method, and a
+  service method calling another service's method that needs more.
 - **Admin users page** (`/api/admin/**`, active role PLATFORM_ADMIN): search and page all users, block and unblock
   (`users.enabled`; blocking ends every login, the login then answers `403 ACCOUNT_BLOCKED`, but only after the
   right password), delete (the same flag and nightly cleanup as "Delete my account"). No action on the own account