Harden auth, redaction, upload size checks, and compose token requirements

backend/app/api/router.py

@@ -1,7 +1,8 @@
 """API router registration for all HTTP route modules."""
 
-from fastapi import APIRouter
+from fastapi import APIRouter, Depends
 
+from app.api.auth import require_admin, require_user_or_admin
 from app.api.routes_documents import router as documents_router
 from app.api.routes_health import router as health_router
 from app.api.routes_processing_logs import router as processing_logs_router
@@ -11,7 +12,27 @@ from app.api.routes_settings import router as settings_router
 
 api_router = APIRouter()
 api_router.include_router(health_router)
-api_router.include_router(documents_router, prefix="/documents", tags=["documents"])
-api_router.include_router(processing_logs_router, prefix="/processing/logs", tags=["processing-logs"])
-api_router.include_router(search_router, prefix="/search", tags=["search"])
-api_router.include_router(settings_router, prefix="/settings", tags=["settings"])
+api_router.include_router(
+    documents_router,
+    prefix="/documents",
+    tags=["documents"],
+    dependencies=[Depends(require_user_or_admin)],
+)
+api_router.include_router(
+    processing_logs_router,
+    prefix="/processing/logs",
+    tags=["processing-logs"],
+    dependencies=[Depends(require_admin)],
+)
+api_router.include_router(
+    search_router,
+    prefix="/search",
+    tags=["search"],
+    dependencies=[Depends(require_user_or_admin)],
+)
+api_router.include_router(
+    settings_router,
+    prefix="/settings",
+    tags=["settings"],
+    dependencies=[Depends(require_admin)],
+)