[codex] Secure schedule finish authorization

[jjoonleo]

Summary

• bind the finish endpoint path scheduleId and make it authoritative
• validate optional body scheduleId mismatch with a 400 error
• authorize schedule ownership before lateness and punctuality score mutation
• reject repeated finish calls to avoid double-counting punctuality score
• add regression coverage for success, missing schedule, wrong owner, mismatch, and repeated finish

Root cause

The finish endpoint ignored the path parameter and the service loaded the schedule directly from the request body UUID, so any authenticated user could finish another user's schedule if they knew or guessed its UUID.

Validation

• ./gradlew compileTestJava
• ./gradlew test --tests devkor.ontime_back.controller.ScheduleControllerTest

Note: the focused ScheduleServiceTest class could not be executed locally because the Spring Boot test context attempted to connect to MySQL and the local connection was refused.

Closes #272

[github-actions]

실패하는 테스트코드가 있어 PR이 자동으로 닫혔습니다.
Github Action에서 자세한 실패 로그를 확인하고 코드를 수정하세요.

[github-actions]

실패하는 테스트코드가 있어 PR이 자동으로 닫혔습니다.
Github Action에서 자세한 실패 로그를 확인하고 코드를 수정하세요.