fix(backend): require every granted scope

[bamiebot-maker]

Summary

• correct the inverted predicate in �ackend/src/middleware/jwtAuth.ts
  equireScopes
• reject authenticated callers when any required scope is absent
• preserve the �dmin:all bypass
• add a regression test for a caller holding only one of multiple required scopes

Closes #1362

Validation

pm test -- --runInBand src/middleware/tests/jwtAuth.test.ts — 17 passed

pm run typecheck — passed

• focused ESLint for the changed source and test — passed
• git diff --check — passed

[bamiebot-maker]

CI audit: focused jwtAuth tests (17/17), backend typecheck, and focused lint all pass locally. Passing CI jobs include scripts typecheck, env docs, migration paths, and supply-chain audit. Failed matrix jobs are unrelated baseline failures: backend lint flags existing formatting in �uditLog.ts/
equestLogger.ts, frontend has existing store/amount/CSV/hook test failures, and contracts have existing lending-pool failures. The PR touches only
equireScopes and its regression test.