Restrict observability endpoints to ops admins

frontend/app/api/system/status/route.ts

@@ -1,5 +1,10 @@
 import { NextRequest, NextResponse } from "next/server";
-import { proxyBackendJsonGet } from "@/lib/api-proxy";
+import { buildProxyExceptionResponse } from "@/lib/api-proxy";
+import {
+  applyAuthResponseCookies,
+  buildBackendRequestHeaders,
+} from "@/lib/backend-auth";
+import { requireOpsProxyAuth } from "@/lib/ops-proxy-auth";
 
 const API_BASE = process.env.POLYWEATHER_API_BASE_URL;
 
@@ -11,11 +16,28 @@ export async function GET(req: NextRequest) {
     );
   }
 
-  return proxyBackendJsonGet(req, {
-    cacheControl: "public, max-age=0, s-maxage=30, stale-while-revalidate=120",
-    detailLimit: 500,
-    publicMessage: "Failed to fetch system status",
-    revalidateSeconds: 30,
-    url: `${API_BASE}/api/system/status`,
-  });
+  try {
+    const auth = await buildBackendRequestHeaders(req);
+    const authError = requireOpsProxyAuth(req, auth);
+    if (authError) return authError;
+
+    const res = await fetch(`${API_BASE}/api/system/status`, {
+      cache: "no-store",
+      headers: auth.headers,
+    });
+    const raw = await res.text();
+    const response = new NextResponse(raw, {
+      headers: {
+        "Cache-Control": "no-store",
+        "Cloudflare-CDN-Cache-Control": "no-store",
+        "Content-Type": res.headers.get("content-type") || "application/json",
+      },
+      status: res.status,
+    });
+    return applyAuthResponseCookies(response, auth.response);
+  } catch (error) {
+    return buildProxyExceptionResponse(error, {
+      publicMessage: "Failed to fetch system status",
+    });
+  }
 }