fix(api): enforce late controller guards

[Upd4ting]

🔗 Linked issue

No linked issue.

❓ Type of change

• 🐞 Bug fix (a non-breaking change that fixes an issue)
• 👌 Enhancement (improving an existing functionality like performance)
• ✨ New feature (a non-breaking change that adds functionality)
• ⚠️ Breaking change (fix or feature that would cause existing functionality to change)

📚 Description

Compile handler plans when the first request arrives rather than during route registration. This ensures controller metadata added after route registration, including class-level authorization guards, is present in the compiled plan.

Preserve symbol-keyed computed controller properties by enumerating metadata with Reflect.ownKeys.

Regression tests cover metadata finalized after registration and symbol-keyed computed properties. Real CMS authorization checks with the corrected provider restore owner/member/anonymous outcomes to 200/403/401.

Verification

• pnpm lint: pass
• pnpm build: pass
• New controller-resolution tests: pass
• Full suite: 172 passing / 2 pre-existing failures
• Exact v1.2.4 base under the same AJS 1.4.11 environment: 170 passing / the same 2 failures (AmbiguousProviderError in Route lifecycle and RateLimit)

📝 Checklist

• I have linked an issue or discussion.
• I have updated the documentation accordingly.