feat(aoc): add RequireAocGuard route helper and associated tests

- Introduced RequireAocGuard extension method for RouteHandlerBuilder to enforce AOC guard on routes.
- Implemented two overloads of RequireAocGuard to support different payload selection strategies.
- Added unit tests for RequireAocGuard to ensure correct behavior and exception handling.
- Updated TASKS.md to reflect the addition of RequireAocGuard and related documentation.
- Made internal members of Concelier.WebService visible to its test project.

docs/aoc/guard-library.md

@@ -73,6 +73,8 @@ Key points:
 - Register the guard singleton before wiring repositories or worker services.
 - Use `AocGuardEndpointFilter<TRequest>` to protect Minimal API endpoints. The `payloadSelector`
   can yield multiple payloads (e.g. batch ingestion) and the filter will validate each one.
+- Prefer the `RequireAocGuard` extension when wiring endpoints; it wraps `AddEndpointFilter`
+  and handles single-payload scenarios without additional boilerplate.
 - Wrap guard exceptions with `AocHttpResults.Problem` to ensure clients receive machine-readables codes (`ERR_AOC_00x`).
 
 ## Worker / repository usage