feat(auth): register StrategyAuthGuard globally & consolidate auth flow

[NteinPrecious]

Summary

Closes #8

• Global StrategyAuthGuard: StrategyAuthGuard is now registered as the first APP_GUARD in AppModule, so every route is protected by default via the pluggable strategy system (wallet, traditional, OAuth, API-key). No more per-controller @UseGuards(JwtAuthGuard) needed for new routes.
• @Public() on open endpoints: GET /health and GET /info in AppController are decorated with @Public() so they remain unauthenticated. StrategyAuthGuard already reads IS_PUBLIC_KEY via Reflector to skip those routes.
• TokenBlacklistService injection verified: TokenBlacklistService is already exported from AuthModule and injected into AuthService.logout() (which calls tokenBlacklist.revoke(jti, exp)). EnhancedAuthService uses refresh-token table revocation; WalletAuthService has no logout path — no additional injection required.
• Legacy AuthService deprecated: AuthService.register() and AuthService.login() now carry @deprecated JSDoc comments directing callers to EnhancedAuthService, which adds refresh-token rotation and 2FA.
• Auth architecture documented: A JSDoc block above @Module() in auth.module.ts explains all three flows (legacy, enhanced, strategy) and their boundaries.
• Build passes: npm run build compiles with zero errors.

Test plan

• GET /health and GET /info return 200 without an Authorization header
• Any other route (e.g. GET /protected) returns 401 without a valid Bearer token
• A valid JWT issued by any registered strategy (wallet, traditional, etc.) grants access to protected routes
• AuthService.register / AuthService.login show @deprecated in IDE tooling
• npm run build passes cleanly