fix(console): enforce protected API routing

[GatewayJ]

Type of Change

• New Feature
• Bug Fix
• Documentation
• Performance Improvement
• Test/CI
• Refactor
• Other:

Related Issues

Closes rustfs/backlog#1099

Summary of Changes

• Split Console API routing into explicit public and protected route trees.
• Apply session authentication directly to the protected router, including /session and all tenant, pool, pod, event, cluster, and topology APIs.
• Remove path-prefix and static-path exemptions from the authentication middleware.
• Add regression coverage proving /session is protected while /logout remains explicitly public.
• Preserve response and pool lifecycle semantics while satisfying Rust 1.98 result_large_err clippy checks.

The previous global middleware used request path strings as a fail-open allowlist, including every path outside /api/v1. Router composition now defines the trust boundary, so newly added protected API routes cannot silently bypass authentication because of their path.

Checklist

• I have read and followed the CONTRIBUTING.md guidelines
• Passed make pre-commit (fmt-check + clippy + test + console-lint + console-fmt-check)
• Added/updated necessary tests
• Documentation updated (N/A: public endpoints and session behavior are unchanged)
• CHANGELOG.md updated under [Unreleased] (N/A: no changelog file exists in the repository)
• CI/CD passed

Impact

• Breaking change (CRD/API compatibility)
• Requires doc/config/deployment update
• Other impact: health, readiness, metrics, OpenAPI, Swagger UI, static assets, login, and logout remain explicitly unauthenticated.

Verification

rustc --version
# rustc 1.98.0 (88d9e12ae 2026-08-18)
make pre-commit

Additional Notes

OPTIONS requests continue to bypass session validation so browser CORS preflight behavior is preserved.

---

Thank you for your contribution! Please ensure your PR follows the community standards (CODE_OF_CONDUCT.md) and sign the CLA if this is your first contribution.

[GatewayJ]

@codex

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 🚀

Reviewed commit: 629f3cc769

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".