feat: Intégration du backend NestJS depuis YNOV

- Framework: NestJS avec TypeORM
- Authentification: JWT (access + refresh tokens)
- Gestion utilisateurs: CRUD complet avec validation
- Routes: auth, users, parents, assistantes maternelles
- Dockerfile pour conteneurisation

backend/src/common/guards/auth.guard.ts

@@ -0,0 +1,49 @@
+import { CanActivate, ExecutionContext, Injectable, UnauthorizedException } from "@nestjs/common";
+import { Reflector } from "@nestjs/core";
+import { JwtService } from "@nestjs/jwt";
+import { Request } from 'express';
+import { IS_PUBLIC_KEY } from "../decorators/public.decorator";
+import { ConfigService } from "@nestjs/config";
+
+@Injectable()
+export class AuthGuard implements CanActivate {
+  constructor(
+    private readonly jwtService: JwtService,
+    private readonly reflector: Reflector,
+    private readonly configService: ConfigService,
+  ) {}
+
+  async canActivate(context: ExecutionContext): Promise<boolean> {
+    const isPublic = this.reflector.getAllAndOverride<boolean>(IS_PUBLIC_KEY, [
+      context.getHandler(),
+      context.getClass(),
+    ]);
+    if (isPublic) return true;
+
+    const request = context.switchToHttp().getRequest<Request>();
+    if (request.path.startsWith('/api-docs')) {
+      return true;
+    }
+
+    const authHeader = request.headers['authorization'] as string | undefined;
+    if (!authHeader || !authHeader.startsWith('Bearer ')) {
+      throw new UnauthorizedException('Token manquant ou invalide');
+    }
+
+    const token = authHeader.split(' ')[1];
+    try {
+      const payload = await this.jwtService.verifyAsync(token, {
+        secret: this.configService.get<string>('jwt.accessSecret'),
+      });
+
+      request.user = {
+        ...payload,
+        id: payload.sub,
+      };
+
+      return true;
+    } catch (error) {
+      throw new UnauthorizedException('Token invalide ou expiré');
+    }
+  }
+}