Add requireAgent guard to analytics and export routes

Both endpoints were authenticated but had no role check, allowing any
logged-in USER to view company-wide analytics and export all tickets.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

server/src/routes/analytics.ts

@@ -1,9 +1,10 @@
 import { Router } from 'express';
 import * as analyticsService from '../services/analyticsService';
+import { requireAgent } from '../middleware/auth';
 
 const router = Router();
 
-router.get('/summary', async (req, res) => {
+router.get('/summary', requireAgent, async (req, res) => {
   const raw = Number(req.query.window);
   const window: analyticsService.AnalyticsWindow =
     raw === 14 || raw === 30 || raw === 90 ? raw : 30;

server/src/routes/export.ts

@@ -1,5 +1,6 @@
 import { Router } from 'express';
 import * as ticketService from '../services/ticketService';
+import { requireAgent } from '../middleware/auth';
 
 const router = Router();
 
@@ -10,7 +11,7 @@ function csvEscape(v: unknown): string {
   return s;
 }
 
-router.get('/tickets.csv', async (req, res) => {
+router.get('/tickets.csv', requireAgent, async (req, res) => {
   const { status, severity, assigneeId, categoryId, typeId, itemId, search } = req.query;
 
   const tickets = await ticketService.listTickets({