#304: declare the font-list route's access rule explicitly

The route-permission fence (#52) failed in CI, not locally: I had run the
fonts and import-export suites, not the full api suite, and that fence needs
a database. `@AuthenticatedOnly()` is the rule the route always meant — a
session, no further permission.

Re-verified with the FULL api suite against a fresh database: 103 files /
575 tests passed.

apps/api/src/fonts/custom-fonts.controller.ts

@@ -23,6 +23,7 @@ import type { Response } from 'express';
 
 import { SiteAdminGuard } from '../admin/site-admin.guard';
 import { AuthedRequest, Public } from '../auth/auth.guard';
+import { AuthenticatedOnly } from '../permissions/permission.decorators';
 import { CustomFontStorageService } from './custom-font-storage.service';
 import { CustomFontsService, WeightUpload } from './custom-fonts.service';
 
@@ -125,6 +126,10 @@ export class CustomFontsFileController {
     private readonly fonts: CustomFontsService,
   ) {}
 
+  // Explicit access declaration, as every route needs (issue #52's fence
+  // `route-permissions.e2e.db.test.ts`): a session, no further permission —
+  // the list says which families exist, which is what the pickers offer.
+  @AuthenticatedOnly()
   @Get()
   list(): Promise<CustomFontView[]> {
     return this.fonts.list();