recalculation endpoint

[Cofez]

Description

Adds adminAuth middleware to the POST /api/risk-score/recalculate endpoint, restricting batch risk recalculation to admin users only. Previously, any authenticated user could trigger a full recalculation across all subscriptions, creating a denial-of-service risk.

---

Related Issue

Closes #119

---

Changes

• Imported adminAuth from ../middleware/admin into risk-score.ts
• Applied adminAuth middleware to the /recalculate route handler
• Updated OpenAPI docs to include 403 Forbidden response
• Removed stale // TODO: Add admin check comment

---

Test Plan

• Tested locally
• Non-admin user receives 403 when calling POST /api/risk-score/recalculate
• Admin user can still trigger recalculation successfully
• Other risk-score endpoints (GET /, GET /:subscriptionId, POST /:subscriptionId/calculate) remain accessible to all authenticated users
• No regressions introduced

---

Screenshots (if applicable)

N/A

---

Checklist

• Code builds successfully
• Follows project conventions
• No sensitive data exposed
• Tests pass

[drips-wave]

@Cofez Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits