fix: scope XP award publication to the authenticated learner

[AzahasTech]

Overview

This PR enforces learner scoping on XP award publication so that a learner can only publish award events for themselves. The controller now derives the acting learner from the authenticated request context, and the service rejects any attempt to publish an award event on behalf of a different learner.

Related Issue

Changes

🔒 Learner-Scoped XP Publication

• [MODIFY] BackendAcademy/src/gamification/xp.controller.ts

  • Resolve the acting learner from the authenticated request instead of trusting a learner identifier supplied in the request body.
  • Pass the resolved learner identity through to the service when publishing an award event.

• [MODIFY] BackendAcademy/src/gamification/xp.service.ts

  • Add a learner-scope check in the publish path that rejects award events targeting a learner other than the acting learner.
  • Surface a clear error when the scope check fails so callers cannot silently publish cross-learner awards.

• [MODIFY] BackendAcademy/src/gamification/xp.service.spec.ts

  • Add coverage for the allowed case (learner publishing their own award event).
  • Add coverage for the rejected case (learner attempting to publish an award event for another learner).

Verification Results

npm test -- BackendAcademy/src/gamification/xp.service.spec.ts
✅ XP service spec passes, including new learner-scope cases

Acceptance Criteria	Status
Prevent one learner from publishing an award event for another learner	✅ Service rejects cross-learner publication; controller derives learner from auth context

Closes #999