move API protection check into hooks, adjusting corresponding tests

src/routes/api/list/+server.ts

@@ -2,9 +2,6 @@ import { getVorgaenge } from '$lib/server/vorgangService';
 import { json } from '@sveltejs/kit';
 
 export async function GET({ locals }) {
-	if (!locals.user) {
-		return json({ error: 'Unauthorized' }, { status: 401 });
-	}
 	const vorgaenge = getVorgaenge();
 
 	return new Response(JSON.stringify(vorgaenge), {