fix: add local _require_admin guard to proxied endpoints; update test to expect 503 without bincio-auth

bincio/serve/routers/admin.py

@@ -165,6 +165,7 @@ async def admin_reset_password_code(
     bincio_session: str | None = Cookie(default=None),
 ) -> JSONResponse:
     """Generate a one-time password reset code for a user. Proxied to bincio-auth."""
+    deps._require_admin(bincio_session)
     return await _auth_proxy("POST", f"/api/admin/users/{handle}/reset-password-code", bincio_session)
 
 
@@ -174,6 +175,7 @@ async def admin_suspend(
     bincio_session: str | None = Cookie(default=None),
 ) -> JSONResponse:
     """Suspend a user account. Proxied to bincio-auth."""
+    deps._require_admin(bincio_session)
     return await _auth_proxy("POST", f"/api/admin/users/{handle}/suspend", bincio_session)
 
 
@@ -183,6 +185,7 @@ async def admin_unsuspend(
     bincio_session: str | None = Cookie(default=None),
 ) -> JSONResponse:
     """Re-enable a suspended user account. Proxied to bincio-auth."""
+    deps._require_admin(bincio_session)
     return await _auth_proxy("POST", f"/api/admin/users/{handle}/unsuspend", bincio_session)
 
 
@@ -192,6 +195,7 @@ async def admin_delete_account(
     bincio_session: str | None = Cookie(default=None),
 ) -> JSONResponse:
     """Delete a user account. Proxied to bincio-auth."""
+    deps._require_admin(bincio_session)
     return await _auth_proxy("DELETE", f"/api/admin/users/{handle}/account", bincio_session)