[BUG]: Referral route auth middleware mismatch #251

Issue Details

Where: backend/routes/referral.routes.js, backend/controllers/referral.controller.js
Problem: router.post('/:id/apply', authenticate, isStudent, applyForReferral) requires student. But applyForReferral also checks currentUser.type !== 'student'. That’s redundant; more importantly, other endpoints that should be role-gated are only authenticate (e.g., sendReferralMessage, getReferralTimeline, getReferralById).
Impact: Potential privilege escalation (authenticated non-owners/non-applicants hitting endpoints).
Fix steps
Add authorization checks (or reuse getReferralAccess) consistently in getReferralTimeline and getReferralById.
Consider splitting routes by access role (poster/applicant/admin).
Keep server-side checks as source of truth; don’t rely on frontend.