fix(security): enforce admin auth guards across sensitive backend routes and eliminate BOM data leak

apps/backend/src/routes/shopee.ts

@@ -1,5 +1,6 @@
 import { Elysia, t } from "elysia";
 import prisma from "../lib/prisma";
+import { adminOnly } from "../middleware/auth";
 import { THAILAND_PROVINCES, findProvince, cleanDistrictName } from "../utils/thaiProvinces";
 
 const toNum = (val: any): number => {
@@ -17,6 +18,7 @@ function extractShopeeAddress(order: any): { province: string; district: string
 }
 
 export const shopeeRoute = new Elysia({ prefix: "/shopee" })
+  .use(adminOnly)
   // ── Import Orders ─────────────────────────────────────────────────────────
   .post(
     "/import/orders",