refactor(auth,camps): decouple login from medical camp enrollment

Title Fix volunteer latest-camp signup and attendance status handling

Description

Summary This MR fixes backend inconsistencies in the volunteer camp flow by enforcing a strict rule:

→ The latest medical camp by date is the ONLY valid camp → It is active ONLY if its date is today or in the future

Problem

• Incorrect camp selection
• Past camps treated as active
• Wrong signup/attendance state returned
• Frontend receiving inconsistent data

What Changed

• Enforced latest camp as single source of truth
• Added validation to reject past latest camp
• Updated signup-status logic
• Preserved attendance recording flow
• Maintained separation between auth and attendance
• Updated backend tests for new behavior

Behavior After Change

• No camp:

  • signup → no_camp
  • status → no active camp

• Past camp:

  • signup → no_camp
  • status → no active camp

• Future/today camp:

  • correct signup + attendance state returned

Attendance Clarification

• login_time set on entry
• logout_time set on exit
• Auth login DOES NOT affect attendance

Files Affected

• Volunteer camp service
• Signup-status logic
• Signup validation
• Backend tests

Testing

• Medical camp service tests → passed
• API route tests → passed
• Volunteer status validation → passed

Risk

Low–Moderate (logic tightening)

Checklist

• Latest camp enforced
• Past camp rejected
• Signup returns correct state
• Attendance logic intact
• Tests updated and passing