fix(admin): guard GET /api/users/{id} with @RequirePermission(ADMIN_USER)

Fixes IDOR: the endpoint was publicly accessible to any authenticated user.
Now requires ADMIN_USER permission, matching all other user management endpoints.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

frontend/src/routes/admin/page.svelte.spec.ts

@@ -1,83 +1,73 @@
+/**
+ * Tests for the admin root page — the mobile entity picker.
+ * On md+ viewports the page immediately redirects to /admin/users (tested
+ * in e2e). Here we verify the mobile-only list of entity links.
+ */
 import { afterEach, describe, expect, it, vi } from 'vitest';
 import { cleanup, render } from 'vitest-browser-svelte';
 import { page } from 'vitest/browser';
 import Page from './+page.svelte';
 
-vi.mock('$app/forms', () => ({ enhance: () => () => {} }));
+vi.mock('$app/navigation', () => ({ goto: vi.fn() }));
 
-const makeGroup = (overrides = {}) => ({
-	id: 'g1',
-	name: 'Editoren',
-	permissions: ['WRITE_ALL'],
-	...overrides
-});
-
-const makeUser = (overrides = {}) => ({
-	id: 'u1',
-	username: 'max',
-	firstName: 'Max',
-	lastName: 'Mustermann',
-	email: 'max@example.com',
-	birthDate: undefined,
-	contact: undefined,
-	enabled: true,
-	groups: [makeGroup()],
-	createdAt: '2024-01-01T00:00:00Z',
-	...overrides
-});
-
-const baseData = {
-	user: undefined,
-	canWrite: true,
-	canAnnotate: false,
-	users: [makeUser()],
-	groups: [makeGroup()],
-	tags: []
+const fullData = {
+	userCount: 4,
+	groupCount: 3,
+	tagCount: 7,
+	canManageUsers: true,
+	canManageTags: true,
+	canManageGroups: true,
+	canRunMaintenance: true
 };
 
 afterEach(cleanup);
 
-// ─── Users tab ────────────────────────────────────────────────────────────────
-
-describe('Admin page – users tab', () => {
-	it('shows the username in the table', async () => {
-		render(Page, { data: baseData, form: null });
-		await expect.element(page.getByRole('cell', { name: 'max', exact: true })).toBeInTheDocument();
+describe('Admin root page – entity picker', () => {
+	it('renders the admin heading', async () => {
+		render(Page, { data: fullData });
+		await expect.element(page.getByRole('heading')).toBeInTheDocument();
 	});
 
-	it('shows the full name in the table', async () => {
-		render(Page, { data: baseData, form: null });
-		await expect.element(page.getByText(/Max Mustermann/)).toBeInTheDocument();
-	});
-
-	it('shows a dash when user has no name set', async () => {
-		const data = { ...baseData, users: [makeUser({ firstName: undefined, lastName: undefined })] };
-		render(Page, { data, form: null });
-		await expect.element(page.getByText('–')).toBeInTheDocument();
-	});
-
-	it('shows group badges for the user', async () => {
-		render(Page, { data: baseData, form: null });
-		await expect.element(page.getByText('Editoren')).toBeInTheDocument();
-	});
-
-	it('edit link points to /admin/users/[id]', async () => {
-		render(Page, { data: baseData, form: null });
+	it('renders users link pointing to /admin/users', async () => {
+		render(Page, { data: fullData });
 		await expect
-			.element(page.getByRole('link', { name: /Bearbeiten/i }))
-			.toHaveAttribute('href', '/admin/users/u1');
+			.element(page.getByRole('link', { name: /benutzer/i }))
+			.toHaveAttribute('href', '/admin/users');
 	});
 
-	it('new user button links to /admin/users/new', async () => {
-		render(Page, { data: baseData, form: null });
+	it('renders groups link pointing to /admin/groups', async () => {
+		render(Page, { data: fullData });
 		await expect
-			.element(page.getByRole('link', { name: /Neuer Benutzer/i }))
-			.toHaveAttribute('href', '/admin/users/new');
+			.element(page.getByRole('link', { name: /gruppen/i }))
+			.toHaveAttribute('href', '/admin/groups');
 	});
 
-	it('shows "no groups" label when user has no groups', async () => {
-		const data = { ...baseData, users: [makeUser({ groups: [] })] };
-		render(Page, { data, form: null });
-		await expect.element(page.getByText(/Keine Gruppen/i)).toBeInTheDocument();
+	it('renders tags link pointing to /admin/tags', async () => {
+		render(Page, { data: fullData });
+		await expect
+			.element(page.getByRole('link', { name: /schlagworte/i }))
+			.toHaveAttribute('href', '/admin/tags');
+	});
+
+	it('renders system link pointing to /admin/system', async () => {
+		render(Page, { data: fullData });
+		await expect
+			.element(page.getByRole('link', { name: /system/i }))
+			.toHaveAttribute('href', '/admin/system');
+	});
+
+	it('hides users link when canManageUsers is false', async () => {
+		render(Page, { data: { ...fullData, canManageUsers: false } });
+		await expect.element(page.getByRole('link', { name: /benutzer/i })).not.toBeInTheDocument();
+	});
+
+	it('hides system link when canRunMaintenance is false', async () => {
+		render(Page, { data: { ...fullData, canRunMaintenance: false } });
+		await expect.element(page.getByRole('link', { name: /system/i })).not.toBeInTheDocument();
+	});
+
+	it('shows user count', async () => {
+		render(Page, { data: fullData });
+		await expect.element(page.getByText('4')).toBeInTheDocument();
 	});
 });