feat(auth): verify machine tokens for admin read APIs

apps/web/src/lib/discord/suggestions-api.ts

@@ -1,6 +1,5 @@
-import { getServerSession } from "next-auth";
 import { problemDetails } from "@minecraft-account-manager/contracts";
-import { adminAuthOptions, requiredAdminRole } from "@/lib/auth/admin-auth";
+import { authorizeAdminApi } from "@/lib/auth/admin-api-auth";
 import { problemInstance, problemResponse } from "@/lib/problem-response";
 import { createSuggestionsClient, SuggestionsError } from "./suggestions";
 
@@ -17,11 +16,9 @@ function getClient() {
 }
 
 export async function suggestionsApi(request: Request, operation: (client: Client) => Promise<unknown>) {
+  const authorization = await authorizeAdminApi(request);
+  if (authorization.response) return authorization.response;
   try {
-    const session = await getServerSession(adminAuthOptions);
-    if (!session) throw new SuggestionsError(401, "unauthorized", "Sign in as an administrator.");
-    const roles = (session.user as { roles?: unknown } | undefined)?.roles;
-    if (!Array.isArray(roles) || !roles.includes(requiredAdminRole)) throw new SuggestionsError(403, "forbidden", "This API is restricted to administrators.");
     return Response.json(await operation(getClient()), { headers: { "cache-control": "no-store" } });
   } catch (error) {
     const safe = error instanceof SuggestionsError ? error : new SuggestionsError(503, "discord-unavailable", "Discord suggestions are unavailable.");