security(dashboard): enforce admin authentication on all sensitive endpoints

This commit adds the missing auth::require_admin check to all analytics, system info, and configuration list endpoints. It also improves error logging in the usage summary handler to aid in troubleshooting 'Failed to load statistics' errors.

src/dashboard/system.rs

@@ -12,7 +12,15 @@ fn read_proc_file(path: &str) -> Option<String> {
     std::fs::read_to_string(path).ok()
 }
 
-pub(super) async fn handle_system_health(State(state): State<DashboardState>) -> Json<ApiResponse<serde_json::Value>> {
+pub(super) async fn handle_system_health(
+    State(state): State<DashboardState>,
+    headers: axum::http::HeaderMap,
+) -> Json<ApiResponse<serde_json::Value>> {
+    let (_session, _) = match super::auth::require_admin(&state, &headers).await {
+        Ok((session, new_token)) => (session, new_token),
+        Err(e) => return e,
+    };
+
     let mut components = HashMap::new();
     components.insert("api_server".to_string(), "online".to_string());
     components.insert("database".to_string(), "online".to_string());
@@ -67,7 +75,13 @@ pub(super) async fn handle_system_health(State(state): State<DashboardState>) ->
 /// Real system metrics from /proc (Linux only).
 pub(super) async fn handle_system_metrics(
     State(state): State<DashboardState>,
+    headers: axum::http::HeaderMap,
 ) -> Json<ApiResponse<serde_json::Value>> {
+    let (_session, _) = match super::auth::require_admin(&state, &headers).await {
+        Ok((session, new_token)) => (session, new_token),
+        Err(e) => return e,
+    };
+
     // --- CPU usage (aggregate across all cores) ---
     // /proc/stat first line: cpu user nice system idle iowait irq softirq steal guest guest_nice
     let cpu_percent = read_proc_file("/proc/stat")
@@ -220,7 +234,15 @@ pub(super) async fn handle_system_metrics(
     })))
 }
 
-pub(super) async fn handle_system_logs(State(state): State<DashboardState>) -> Json<ApiResponse<serde_json::Value>> {
+pub(super) async fn handle_system_logs(
+    State(state): State<DashboardState>,
+    headers: axum::http::HeaderMap,
+) -> Json<ApiResponse<serde_json::Value>> {
+    let (_session, _) = match super::auth::require_admin(&state, &headers).await {
+        Ok((session, new_token)) => (session, new_token),
+        Err(e) => return e,
+    };
+
     let pool = &state.app_state.db_pool;
 
     let result = sqlx::query(
@@ -318,7 +340,15 @@ pub(super) async fn handle_system_backup(
     }
 }
 
-pub(super) async fn handle_get_settings(State(state): State<DashboardState>) -> Json<ApiResponse<serde_json::Value>> {
+pub(super) async fn handle_get_settings(
+    State(state): State<DashboardState>,
+    headers: axum::http::HeaderMap,
+) -> Json<ApiResponse<serde_json::Value>> {
+    let (_session, _) = match super::auth::require_admin(&state, &headers).await {
+        Ok((session, new_token)) => (session, new_token),
+        Err(e) => return e,
+    };
+
     let registry = &state.app_state.model_registry;
     let provider_count = registry.providers.len();
     let model_count: usize = registry.providers.values().map(|p| p.models.len()).sum();