feat: add version check app

apps/api/src/devices/devices.controller.ts

@@ -21,6 +21,7 @@ import { DevicesService } from './devices.service';
 import { AuthService } from '../auth/auth.service';
 import { JwtAuthGuard } from '../auth/guards/jwt-auth.guard';
 import { DeviceAuthGuard } from '../auth/guards/device-auth.guard';
+import { AppVersionGuard } from './app-version.guard';
 import { RolesGuard } from '../common/guards/roles.guard';
 import { Roles } from '../common/decorators/roles.decorator';
 import { RegisterDeviceDto } from './dto/register-device.dto';
@@ -38,6 +39,7 @@ export class DevicesController {
 
   @Post('register')
   @Throttle({ default: { limit: 10, ttl: 60000 } })
+  @UseGuards(AppVersionGuard)
   @ApiOperation({ summary: 'Register a new device' })
   @ApiResponse({ status: 201, description: 'Device registered successfully' })
   async register(@Body() dto: RegisterDeviceDto) {
@@ -48,7 +50,7 @@ export class DevicesController {
   // traffic from the venue's shared IP
   @Post(':deviceId/sync')
   @SkipThrottle()
-  @UseGuards(DeviceAuthGuard)
+  @UseGuards(AppVersionGuard, DeviceAuthGuard)
   @ApiOperation({ summary: 'Sync device state with server' })
   @ApiResponse({ status: 200, description: 'Sync successful, returns pending commands' })
   async sync(@Param('deviceId') deviceId: string, @Body() dto: SyncDto, @Req() req: any) {
@@ -59,7 +61,7 @@ export class DevicesController {
   // so an offline edit and its picture follow the same rules as every other change
   @Post(':deviceId/images')
   @SkipThrottle()
-  @UseGuards(DeviceAuthGuard)
+  @UseGuards(AppVersionGuard, DeviceAuthGuard)
   @UseInterceptors(FileInterceptor('file', { limits: { fileSize: MAX_UPLOAD_BYTES } }))
   @ApiConsumes('multipart/form-data')
   @ApiOperation({ summary: 'Upload a product picture from a terminal' })
@@ -69,7 +71,7 @@ export class DevicesController {
 
   @Post(':deviceId/commands/:commandId/ack')
   @SkipThrottle()
-  @UseGuards(DeviceAuthGuard)
+  @UseGuards(AppVersionGuard, DeviceAuthGuard)
   @ApiOperation({ summary: 'Acknowledge a command result' })
   @ApiResponse({ status: 200, description: 'Command acknowledged' })
   async ackCommand(