feat(backend): enforce admin-only ops endpoints and cover destructive cleanup smoke

restrict ops endpoints to admin-only access

block operator and viewer keys from admin maintenance routes
cover destructive pricing cleanup in smoke execution, not only preview

extend orchestration without regressing existing smoke stages

backend/app/api/routes/admin_cleanup.py

@@ -6,7 +6,7 @@ from app.schemas.admin_cleanup import (
     PricingCleanupExecuteResponse,
     PricingCleanupPreviewResponse,
 )
-from app.security.auth import require_api_key
+from app.security.auth import require_admin_api_key
 from app.services.pricing_cleanup import (
     build_pricing_cleanup_preview,
     execute_pricing_cleanup,
@@ -25,7 +25,7 @@ async def get_pricing_cleanup_preview(
     name_prefix: list[str] = Query(default_factory=list),
     pricing_category_id: list[str] = Query(default_factory=list),
     delete_only_without_rules: bool = Query(default=True),
-    role: str = Depends(require_api_key),
+    role: str = Depends(require_admin_api_key),
 ):
     return await build_pricing_cleanup_preview(
         scheme_id=scheme_id,
@@ -43,7 +43,7 @@ async def get_pricing_cleanup_preview(
 async def post_pricing_cleanup(
     scheme_id: str,
     payload: PricingCleanupExecuteRequest,
-    role: str = Depends(require_api_key),
+    role: str = Depends(require_admin_api_key),
 ):
     return await execute_pricing_cleanup(
         scheme_id=scheme_id,