Closes the CWE-285 gap Nora flagged on issue #296: both endpoints expose enrichment-queue information that only writers should see. Brings them in line with the new /incomplete list endpoint and every other write-path under DocumentController. Frontend callers (/enrich/[id]/+page.server.ts) already gate on WRITE_ALL at the route level, so no client-side change is needed. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>