feat: enforce api permissions

backend/apps/audit/tests/test_audit_api.py

@@ -1,7 +1,7 @@
 from apps.audit.models import OperationAuditLog
 
 
-def test_list_operation_logs_returns_recent_logs(client, db):
+def test_list_operation_logs_returns_recent_logs(admin_client, db):
     OperationAuditLog.objects.create(
         module="system",
         action="health_check",
@@ -11,7 +11,7 @@ def test_list_operation_logs_returns_recent_logs(client, db):
         request_snapshot={"path": "/api/system/health"},
     )
 
-    response = client.get("/api/audit/operation-logs")
+    response = admin_client.get("/api/audit/operation-logs")
 
     assert response.status_code == 200
     payload = response.json()