fix(analytics): restrict operators endpoint to admin [FASE-2.5]

Align with BI security spec and add flat JSON API tests for coverage, tests, and operators.

backend/app/routers/analytics.py

@@ -8,7 +8,7 @@ from fastapi import APIRouter, Depends, Query
 from sqlalchemy.orm import Session
 
 from app.database import get_db
-from app.dependencies.auth import get_current_user, require_any_role
+from app.dependencies.auth import get_current_user, require_role
 from app.models.user import User
 from app.services import analytics_service
 
@@ -49,7 +49,7 @@ def analytics_trends(
 @router.get("/operators")
 def analytics_operators(
     db: Session = Depends(get_db),
-    user: User = Depends(require_any_role("red_lead", "blue_lead")),
+    user: User = Depends(require_role("admin")),
 ):
     """Per-operator metrics — for workload management dashboards."""
     return analytics_service.get_operators_analytics(db)