Fail closed for auth-enabled routes

[MaxGhenis]

Summary

• raise a configuration error when auth is enabled without the required Auth0 settings
• require auth on /<country_id>/calculate_demo so the demo endpoint cannot bypass protection
• add regression tests for the fail-closed decorator behavior and calculate_demo auth

Testing

• uv run pytest tests/unit/decorators/test_auth.py tests/unit/endpoints/test_calculate_demo_auth.py -q