fix(security): resolve vulnerability scan findings

- Added requireManagementAuth to /api/logs/export
- Added requireManagementAuth to /api/logs/console
- Added requireManagementAuth to /api/compliance/audit-log
- Increased minimum password length from 4 to 8 in reset-password CLI

bin/reset-password.mjs

@@ -70,10 +70,10 @@ async function main() {
     console.log("ℹ️  No password is currently set.");
   }
 
-  const password = await ask("Enter new password (min 4 chars): ");
+  const password = await ask("Enter new password (min 8 chars): ");
 
-  if (!password || password.length < 4) {
-    console.error("\n❌ Password must be at least 4 characters.\n");
+  if (!password || password.length < 8) {
+    console.error("\n❌ Password must be at least 8 characters.\n");
     db.close();
     rl.close();
     process.exit(1);

src/app/api/compliance/audit-log/route.ts

@@ -1,5 +1,6 @@
 import { NextResponse } from "next/server";
 import { countAuditLog, getAuditLog } from "@/lib/compliance/index";
+import { requireManagementAuth } from "@/lib/api/requireManagementAuth";
 
 export const dynamic = "force-dynamic";
 
@@ -10,6 +11,9 @@ function parsePagination(value: string | null, fallback: number, min: number, ma
 }
 
 export async function GET(request) {
+  const authError = await requireManagementAuth(request);
+  if (authError) return authError;
+
   try {
     const { searchParams } = new URL(request.url);
     const filters = {

src/app/api/logs/console/route.ts

@@ -13,6 +13,7 @@
 import { NextRequest, NextResponse } from "next/server";
 import { readFileSync, existsSync } from "fs";
 import { getAppLogFilePath } from "@/lib/logEnv";
+import { requireManagementAuth } from "@/lib/api/requireManagementAuth";
 
 const LEVEL_ORDER: Record<string, number> = {
   trace: 5,
@@ -45,6 +46,9 @@ function parseLevel(raw: string | number): string {
 }
 
 export async function GET(req: NextRequest) {
+  const authError = await requireManagementAuth(req);
+  if (authError) return authError;
+
   try {
     const { searchParams } = new URL(req.url);
     const levelFilter = searchParams.get("level") || "all";

src/app/api/logs/export/route.ts

@@ -1,5 +1,6 @@
 import { getDbInstance } from "@/lib/db/core";
 import { exportCallLogsSince } from "@/lib/usage/callLogs";
+import { requireManagementAuth } from "@/lib/api/requireManagementAuth";
 
 /**
  * GET /api/logs/export — export logs as JSON
@@ -7,6 +8,9 @@ import { exportCallLogsSince } from "@/lib/usage/callLogs";
  *               &type=call-logs|request-logs|proxy-logs (default call-logs)
  */
 export async function GET(request: Request) {
+  const authError = await requireManagementAuth(request);
+  if (authError) return authError;
+
   try {
     const { searchParams } = new URL(request.url);
     const hours = Math.min(Math.max(parseInt(searchParams.get("hours") || "24") || 24, 1), 168);