fix(backend): Add [Authorize] attribute to Epic/Story/Task controllers

CRITICAL FIX: Added missing [Authorize] attribute to prevent unauthorized access.

Changes:
- EpicsController: Added [Authorize] attribute
- StoriesController: Added [Authorize] attribute
- TasksController: Added [Authorize] attribute
- All controllers now require JWT authentication

Security Impact:
- Before: Anonymous access allowed (HIGH RISK)
- After: JWT authentication required (SECURE)

This fixes 401 "Tenant ID not found in claims" errors that occurred when
users tried to create Epics/Stories/Tasks without proper authentication.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

colaflow-api/src/ColaFlow.API/Controllers/EpicsController.cs

@@ -1,4 +1,5 @@
 using MediatR;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using ColaFlow.Modules.ProjectManagement.Application.DTOs;
 using ColaFlow.Modules.ProjectManagement.Application.Commands.CreateEpic;
@@ -13,6 +14,7 @@ namespace ColaFlow.API.Controllers;
 /// </summary>
 [ApiController]
 [Route("api/v1")]
+[Authorize]
 public class EpicsController(IMediator mediator) : ControllerBase
 {
     private readonly IMediator _mediator = mediator ?? throw new ArgumentNullException(nameof(mediator));

colaflow-api/src/ColaFlow.API/Controllers/StoriesController.cs

@@ -1,4 +1,5 @@
 using MediatR;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using ColaFlow.Modules.ProjectManagement.Application.DTOs;
 using ColaFlow.Modules.ProjectManagement.Application.Commands.CreateStory;
@@ -16,6 +17,7 @@ namespace ColaFlow.API.Controllers;
 /// </summary>
 [ApiController]
 [Route("api/v1")]
+[Authorize]
 public class StoriesController(IMediator mediator) : ControllerBase
 {
     private readonly IMediator _mediator = mediator ?? throw new ArgumentNullException(nameof(mediator));

colaflow-api/src/ColaFlow.API/Controllers/TasksController.cs

@@ -1,4 +1,5 @@
 using MediatR;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using ColaFlow.Modules.ProjectManagement.Application.DTOs;
 using ColaFlow.Modules.ProjectManagement.Application.Commands.CreateTask;
@@ -17,6 +18,7 @@ namespace ColaFlow.API.Controllers;
 /// </summary>
 [ApiController]
 [Route("api/v1")]
+[Authorize]
 public class TasksController(IMediator mediator) : ControllerBase
 {
     private readonly IMediator _mediator = mediator ?? throw new ArgumentNullException(nameof(mediator));