Addresses @markus/@nora suggestion: makes explicit that the missing @RequirePermission on read endpoints is intentional — all authenticated family members may read the family graph; unauthenticated access is still blocked by Spring Security's anyRequest().authenticated() rule. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>