Restrict expensive viewer endpoints (Refs #72)

src/lib/server/auth/access.ts

@@ -60,6 +60,9 @@ export function routePermission(routeId: string | null, method: string): RoutePe
     if (!reading && ['/api/maintenance', '/api/plutonium', '/api/watchdog'].includes(routeId))
         return 'admin';
 
+    // These reads initiate fleet file scans or spend external API quota.
+    if (routeId === '/api/drift' || routeId === '/api/plugins/github/release') return 'operator';
+
     // Summaries remain visible to viewers; raw configuration, historical file
     // bytes, and unfiltered diagnostics may contain runtime credentials.
     if (