feat: wire and globalise admin security & validation middleware

[Macnelson9]

Summary

closes #446
closes #447
closes #448
closes #449

All four issues share the same root cause: middleware existed but was either missing tests, missing documentation, or not applied to all route groups. This PR resolves all four in a single commit.

---

#446 — Wire admin authentication middleware into admin routes

api_key_middleware was already wired into admin_routes. What was missing were tests.

• Added 3 tests: valid key → 200, missing key → 401, wrong key → 401.

#447 — Wire IP whitelist middleware for admin endpoints

ip_whitelist_middleware was already wired into admin_routes. What was missing were documentation and tests.

• Added doc comment explaining ADMIN_WHITELIST_IPS env var and open-by-default (empty list = allow all) behaviour.
• Added 4 tests: empty list allows all, matching IP via header → 200, non-matching IP → 403, no ConnectInfo + non-empty list → 403.

#448 — Attach security headers middleware globally

security_headers_middleware was applied to public_routes and webhook_routes but missing from newsletter_routes and admin_routes.

• Removed per-group layers from public_routes and webhook_routes.
• Applied once on the top-level app — covers all four route groups with no duplicate headers.
• Added security_headers_middleware_no_duplicates test.

#449 — Attach request validation middleware globally

request_validation_middleware and request_size_validation_middleware were applied to public_routes only; webhook_routes and admin_routes were unprotected.

• Removed per-group layers from public_routes.
• Applied both globally on the top-level app.
• content_type_validation_middleware intentionally stays on newsletter_routes only (rejects missing Content-Type, which would break GET routes elsewhere).
• Added doc comment to request_validation_middleware documenting all rejection rules.
• Added 7 tests: clean request, SQL injection in query, SQL injection in path, path traversal, oversized query string, within-limit body, over-limit body.

Files changed

• services/api/src/main.rs — middleware wiring
• services/api/src/security.rs — doc comment + tests for Wire IP whitelist middleware for admin endpoints #447, tests for Wire admin authentication middleware into admin routes #446 and Attach security headers middleware globally #448
• services/api/src/validation.rs — doc comment + tests for Attach request validation middleware globally #449

[drips-wave]

@Macnelson9 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits