auth: Sprint 02 — auth hardening (Pydantic models, challenge binding, admin gates)

- Add max_length validation to LoginRequest (username 128, password 1024)
- Replace raw request.json() with Pydantic models in RBAC override/update endpoints
- Replace raw request.json() with Pydantic models in passkey register/login/delete
- Bind passkey challenges to session-bound challenge_id (prevents cross-session replay)
- Gate audit log and security log endpoints behind admin role
- Fix fragile opc_db.json.dumps() → import json directly
- Add COOKIE_SECURE=False startup warning (suppress with ALLOW_INSECURE_COOKIES)

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

dashboard/backend/routers/security.py

@@ -4,8 +4,9 @@ from collections import Counter
 from datetime import datetime, time, timedelta, timezone
 
 import docker
-from fastapi import APIRouter, Query
+from fastapi import APIRouter, Depends, HTTPException, Query
 
+import auth_service as auth
 from config import DOCKER_HOST
 
 router = APIRouter()
@@ -203,8 +204,11 @@ def security_logs(
     ip: str | None = Query(None),
     start_date: str | None = Query(None),
     end_date: str | None = Query(None),
+    current_user=Depends(auth.get_current_user),
 ):
-    """Fetch and parse security-relevant logs from Authelia and Caddy."""
+    """Fetch and parse security-relevant logs from Authelia and Caddy. Admin only."""
+    if current_user.role != "admin":
+        raise HTTPException(status_code=403, detail="Admin only")
     results = []
 
     # Authelia logs