fix(dashboard): enforce authentication by route and method

[gys-git]

DIMA: 2026092200119340446

Summary

Anonymous requests with a public-route suffix in the query string could bypass Dashboard authentication and panic while listing tenants.

Solution Description

Restrict anonymous access to the five registered route/method combinations. Validate session identity and expiration, reject missing tenant-list identity before Kubernetes access, and preserve HTTP 401 through the handler.

Regression tests cover query/path suffixes, encoded queries, incorrect methods, public routes, valid and malformed sessions, cookie refresh, and tenant-list error propagation.

Validation

• Baseline: 9201b033b851b74b5c416f4f0b4417b8e8736c48; fix: a7f299969656600c897e403db9ba511a967759cd.
• RED: new baseline tests reproduced authentication bypass and missing-identity panic.
• GREEN: go test -count=1 ./internal/dashboard/middleware ./internal/dashboard/business/oceanbase ./internal/dashboard/handler -run 'TestLoginRequired|TestListAll', also with -race, using isolated local kubeconfig/RBAC fixtures.
• go vet for the three affected packages and make dashboard passed.
• Three independent functional, Go/API, and security/test reviews found no actionable issues.
• Full middleware and handler suites passed. The broader business suite has two existing failures (obcluster_test.go:264 affinity and obcluster_usage_test.go:88 available CPU), reproduced on the unchanged baseline.
• No live deployment was performed.