fix(security) : add ROLE_USER security on all read endpoints

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/Entity/TimeEntry.php

@@ -24,15 +24,16 @@ use Symfony\Component\Serializer\Attribute\Groups;
 
 #[ApiResource(
     operations: [
-        new GetCollection(),
+        new GetCollection(security: "is_granted('ROLE_USER')"),
         new GetCollection(
             name: 'active_time_entry',
             uriTemplate: '/time_entries/active',
             provider: ActiveTimeEntryProvider::class,
             description: 'Get the active timer for the current user',
             paginationEnabled: false,
+            security: "is_granted('ROLE_USER')",
         ),
-        new Get(),
+        new Get(security: "is_granted('ROLE_USER')"),
         new Post(security: "is_granted('ROLE_USER')"),
         new Patch(security: "is_granted('ROLE_ADMIN') or object.getUser() == user"),
         new Delete(security: "is_granted('ROLE_ADMIN') or object.getUser() == user"),