fix: use app.get() for DI in raw routes

test: remove global prefix to see if NestJS controllers work

fix: inject demo userId via Fastify hook, remove Clerk guard from controllers

fix: Critical auth + ownership + container bugs from audit

feat: Full Clerk Google OAuth + user profiles + combined API/Worker deploy