Keep the computer fleet off a signed-in user's listing

[kevin9327]

The problem

The admin computers page asks for every Bot's machine. That list lived behind a session only. :botId is unused, and the handler returns gateway.computers(), so any signed-in person who could hit one valid bot path learned every Bot id and whether its computer was running, including private coworkers.

This is not #35/#37 (acting as another Bot) or #29/#30 (a bot id becoming a filesystem path). It is the global listing, and it does not use the path id.

The approach

The same requireAdmin the policy routes already use. A signed-in user is refused before the gateway is asked. An administrator still gets the fleet.

Proof

• bun test server/tests/computer-routes.test.ts — 2 pass, 0 fail
• bunx biome format / lint on the touched files — clean

Test plan

• Sign in as a non-admin and open /admin/computers or GET /api/computers/<any-bot>/computers. Expect 403 and no fleet.
• Sign in as an administrator and load the same route. Expect the computer list as before.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[davidmckayv]

Right fix, right place, and it uses the requireAdmin the two policy routes in the same file already
use rather than inventing a second shape.

Driven on a real deployment. As a plain member: GET /api/computers/<bot>/computers answers 403 and
/admin/computers redirects away, while that same member still reaches their own Bot's computer, so
the change is narrow. As an administrator the fleet lists as before. I checked the negative too:
without the two added lines, the refusal test fails.

The listed() assertion is the part worth keeping. A check that runs after the gateway has been
asked is a filter on the response rather than a check, and this proves the gateway is never reached.

Two things I changed while rebasing onto main:

• The new test file collided with server/tests/computer-routes.test.ts, which now exists on main.
  I merged the two rather than replacing either, so the screenshot-through-the-gateway test survives
  alongside the fleet ones.
• createComputerRoutes lost its client parameter on main, so the call in the test needed
  updating.

One ordering note, not a problem with this PR: #37 touches the same two files, so whichever of these
lands second needs a rebase.

[davidmckayv]

Right fix, right place, and it uses the requireAdmin the two policy routes in the same file already use rather than inventing a second shape.

Driven on a real deployment. As a plain member, GET /api/computers/<bot>/computers answers 403 and /admin/computers redirects away, while that same member still reaches their own Bot's computer, so the change is narrow. As an administrator the fleet lists as before. I checked the negative too: without the two added lines, the refusal test fails.

The listed() assertion is the part worth keeping. A check that runs after the gateway has been asked is a filter on the response rather than a check, and this proves the gateway is never reached.

Two things I changed while rebasing onto main:

• The new test file collided with server/tests/computer-routes.test.ts, which now exists on main. I merged the two rather than replacing either, so the screenshot-through-the-gateway test survives alongside the fleet ones.
• createComputerRoutes lost its client parameter on main, so the call in the test needed updating.

One ordering note, not a problem with this PR: #37 touches the same two files, so whichever of these lands second needs a rebase.