Fix-[Web]: Guard timesheet report proxy routes and forward the access token

Description

In proxy mode (NEXT_PUBLIC_GAUZY_API_SERVER_URL unset, so the browser goes through the Next.js app/api/** routes), two timesheet report routes were unusable:

• app/api/timesheet/activity/report
• app/api/timesheet/time-log/report/daily

Neither applied authenticatedGuard, and both called their request function without a bearer token. serverFetch only sets the Authorization header when a token is given, so Gauzy rejected the call and the routes answered 500. On top of that, both routes serialised the whole { data, response } object returned by serverFetch instead of data, so even with a token the client hooks would have received an empty report.

The sibling time-log/report/daily-chart route already does all of this correctly; this PR aligns the two routes with it.

What Was Changed

Major Changes

• Both routes run authenticatedGuard before reading any query parameter. Callers whose token Gauzy rejects get a real HTTP 401, which is what the client interceptors react to.
• When the session check itself cannot be completed (Gauzy down, network failure), the routes answer 503 rather than 401, so an outage does not start the client refresh-and-logout flow.
• The caller's access_token is passed to getActivityReportRequest / getTimeLogReportDailyRequest, so Gauzy receives the bearer token.
• The routes return the report payload (data) instead of the serverFetch envelope, like daily-chart.

Minor Changes

• authenticatedGuard now records why /user/me failed and exposes status plus a deny() response builder in its failure branch: Gauzy's own error status (401, 404, 429, 5xx) with its message, or 503 when the check got no answer at all. Existing callers only read user, so nothing changes for them. Its console.error now logs the actual reason instead of a Promise object.
• Parameter parsing, the 400 validation and the 500 handling of both routes are untouched.

How to Test This PR

1. Run the web app in proxy mode: leave NEXT_PUBLIC_GAUZY_API_SERVER_URL unset (that is what switches the browser to the Next.js routes), keep GAUZY_API_SERVER_URL pointing to a Gauzy API, then yarn dev in apps/web. The curl checks below do not depend on the mode.
2. Without being logged in:

   curl -i "http://localhost:3030/api/timesheet/activity/report"
   curl -i "http://localhost:3030/api/timesheet/time-log/report/daily?tenantId=<tenant>&organizationId=<org>&startDate=2026-09-01T00:00:00.000Z&endDate=2026-09-05T23:59:59.999Z"
   

   Both answer 401 {"message":"Unauthorized"}, with or without parameters.
   With GAUZY_API_SERVER_URL pointed at a closed port (for example http://127.0.0.1:9), the same calls answer 503 {"message":"Session check unavailable, retry later"}.
3. Log in, then open the Apps & URLs report and the time-and-activity page. The tables load, and in the network tab both routes answer with a JSON array rather than { "data": [...], "response": {} }.

Screenshots (if needed)

Not applicable, API routes only.

Related Issues

None filed. Found while reviewing the proxy-mode routes against their daily-chart sibling.

Type of Change

• Bug fix (fixes a problem)
• New feature (adds functionality)
• Breaking change (requires changes elsewhere)
• Documentation update

✅ Checklist

• My code follows the project coding style
• I reviewed my own code and added comments where needed
• I tested my changes locally
• I updated or created related documentation if needed
• No new warnings or errors are introduced

Notes for the Reviewer (Optional)

• The guard runs before parameter validation, so an anonymous request always gets 401 rather than a 400 that reveals the expected parameters. daily-chart does it the other way round.
• These routes answer a real HTTP 401. authenticatedGuard's $res('Unauthorized') helper answers HTTP 200 with statusCode: 401 in the body, which the axios interceptors do not treat as unauthorized. The organization-projects/* and integration/* routes already use the real 401.
• Verified locally: anonymous and invalid-token requests on both routes (401 with Gauzy reachable, 503 with Gauzy unreachable), daily-chart and organization-projects unchanged as controls, tsc --noEmit on apps/web. An authenticated end-to-end call was not exercised, hence step 3 above. ESLint does not lint app/api/** with the current flat config.
• Out of scope, pre-existing on both routes: the array filters are read as projectIds[] while the clients send projectIds[0], and source / logType are never forwarded by buildTimeLogParams. Worth a separate PR.

Summary by CodeRabbit

• Bug Fixes
  • Improved authentication handling for activity and daily time-log reports.
  • Authentication failures now preserve appropriate error statuses and messages.
  • Temporary session-check failures continue to return a 503 response with retry guidance.
  • Authenticated report requests now use the correct access credentials and return the expected report data.