fix(security): enforce admin auth guards across sensitive backend routes and eliminate BOM data leak

apps/backend/src/routes/businessAnalytics.ts

@@ -1,5 +1,6 @@
 import { Elysia, t } from "elysia";
 import prisma from "../lib/prisma";
+import { adminOnly } from "../middleware/auth";
 import { THAILAND_PROVINCES, findProvince, findProvinceByPostcode, cleanDistrictName } from "../utils/thaiProvinces";
 
 function extractShopeeAddress(order: any): { province: string; district: string } {
@@ -53,6 +54,7 @@ function buildStatusFilter(statusFilter: string = "completed") {
 }
 
 export const businessAnalyticsRoute = new Elysia({ prefix: "/business-analytics" })
+  .use(adminOnly)
   // ── GET Omnichannel Thailand Sales Map (TikTok + Shopee + Lazada) ──────────
   .get("/sales-map", async ({ query }) => {
     const channel = (query.channel as string) || "all"; // 'all' | 'tiktok' | 'shopee' | 'lazada'