security(dashboard): enforce admin authentication on all sensitive endpoints

This commit adds the missing auth::require_admin check to all analytics, system info, and configuration list endpoints. It also improves error logging in the usage summary handler to aid in troubleshooting 'Failed to load statistics' errors.

src/dashboard/providers.rs

@@ -21,7 +21,15 @@ pub(super) struct UpdateProviderRequest {
     pub(super) billing_mode: Option<String>,
 }
 
-pub(super) async fn handle_get_providers(State(state): State<DashboardState>) -> Json<ApiResponse<serde_json::Value>> {
+pub(super) async fn handle_get_providers(
+    State(state): State<DashboardState>,
+    headers: axum::http::HeaderMap,
+) -> Json<ApiResponse<serde_json::Value>> {
+    let (_session, _) = match super::auth::require_admin(&state, &headers).await {
+        Ok((session, new_token)) => (session, new_token),
+        Err(e) => return e,
+    };
+
     let registry = &state.app_state.model_registry;
     let config = &state.app_state.config;
     let pool = &state.app_state.db_pool;
@@ -154,8 +162,14 @@ pub(super) async fn handle_get_providers(State(state): State<DashboardState>) ->
 
 pub(super) async fn handle_get_provider(
     State(state): State<DashboardState>,
+    headers: axum::http::HeaderMap,
     Path(name): Path<String>,
 ) -> Json<ApiResponse<serde_json::Value>> {
+    let (_session, _) = match super::auth::require_admin(&state, &headers).await {
+        Ok((session, new_token)) => (session, new_token),
+        Err(e) => return e,
+    };
+
     let registry = &state.app_state.model_registry;
     let config = &state.app_state.config;
     let pool = &state.app_state.db_pool;
@@ -351,8 +365,14 @@ pub(super) async fn handle_update_provider(
 
 pub(super) async fn handle_test_provider(
     State(state): State<DashboardState>,
+    headers: axum::http::HeaderMap,
     Path(name): Path<String>,
 ) -> Json<ApiResponse<serde_json::Value>> {
+    let (_session, _) = match super::auth::require_admin(&state, &headers).await {
+        Ok((session, new_token)) => (session, new_token),
+        Err(e) => return e,
+    };
+
     let start = std::time::Instant::now();
 
     let provider = match state.app_state.provider_manager.get_provider(&name).await {