fix(server): 开放可预约时段列表与详情给未登录用户

TimeSlotController 类级的 @UseGuards(JwtAuthGuard) 与服务层 getAvailableSlots
/ getSlotById 的可选 userId 契约不一致，导致游客访问预约课程列表会被 401
拒绝。去掉类级守卫、把两个 GET 端点的 userId 改为可选，未登录时返回
isBookedByMe=false 的公开时段列表，登录时保留个人预约标记。

/api/booking/my 等需要 userId 才能查的接口不受影响。

packages/server/src/time-slot/time-slot.controller.ts

@@ -23,9 +23,14 @@ import { PublishDaySlotsDto } from './dto/publish-day-slots.dto'
 
 // ---------------------------------------------------------------------------
 // Member endpoints
+//
+// These endpoints are intentionally public — they power the "available
+// courses" list and slot detail view that unauthenticated visitors can
+// browse before deciding to log in. The service layer accepts an optional
+// `userId`; when absent, it omits per-user booking flags
+// (`isBookedByMe` / `myBookingId` / `myBookingStatus` are all false/null).
 // ---------------------------------------------------------------------------
 
-@UseGuards(JwtAuthGuard)
 @Controller('time-slot')
 export class TimeSlotController {
   constructor(private readonly timeSlotService: TimeSlotService) {}
@@ -33,7 +38,7 @@ export class TimeSlotController {
   @Get('available')
   getAvailableSlots(
     @Query() query: QuerySlotsDto,
-    @CurrentUser('sub') userId: string,
+    @CurrentUser('sub') userId?: string,
   ) {
     return this.timeSlotService.getAvailableSlots(query.date, userId)
   }
@@ -41,7 +46,7 @@ export class TimeSlotController {
   @Get(':id')
   getSlotById(
     @Param('id') id: string,
-    @CurrentUser('sub') userId: string,
+    @CurrentUser('sub') userId?: string,
   ) {
     return this.timeSlotService.getSlotById(id, userId)
   }