The guard couldn't find the token service
The JWT guard on the clearing-house routes failed at start-up: the token service was registered in the auth module but not visible to the rest of the app.
Exported the JWT module from the auth module so every guarded route resolves the same configuration (1-hour tokens).