security(dashboard): enforce admin authentication on all sensitive endpoints

This commit adds the missing auth::require_admin check to all analytics, system info, and configuration list endpoints. It also improves error logging in the usage summary handler to aid in troubleshooting 'Failed to load statistics' errors.

src/dashboard/models.rs

@@ -43,8 +43,14 @@ pub(super) struct ModelListParams {
 
 pub(super) async fn handle_get_models(
     State(state): State<DashboardState>,
+    headers: axum::http::HeaderMap,
     Query(params): Query<ModelListParams>,
 ) -> Json<ApiResponse<serde_json::Value>> {
+    let (_session, _) = match super::auth::require_admin(&state, &headers).await {
+        Ok((session, new_token)) => (session, new_token),
+        Err(e) => return e,
+    };
+
     let registry = &state.app_state.model_registry;
     let pool = &state.app_state.db_pool;