Restrict analytics, GeoIP status, and OpenAPI spec to admin role

Pentest found that all 8 analytics API endpoints, the GeoIP status
endpoint, and the OpenAPI spec were accessible to any authenticated
user. Since the user role should only have access to forward auth
and self-service, these are now admin-only.

- analytics/*: requireUser → requireAdmin
- geoip-status: requireUser → requireAdmin
- openapi.json: add requireApiAdmin + change Cache-Control to private
- analytics/api-docs pages: requireUser → requireAdmin (defense-in-depth)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

app/api/geoip-status/route.ts

@@ -1,12 +1,12 @@
 import { existsSync } from "node:fs";
 import { NextResponse } from "next/server";
-import { requireUser } from "@/src/lib/auth";
+import { requireAdmin } from "@/src/lib/auth";
 
 const COUNTRY_DB = "/usr/share/GeoIP/GeoLite2-Country.mmdb";
 const ASN_DB = "/usr/share/GeoIP/GeoLite2-ASN.mmdb";
 
 export async function GET() {
-  await requireUser();
+  await requireAdmin();
   return NextResponse.json({
     country: existsSync(COUNTRY_DB),
     asn: existsSync(ASN_DB),