fix: put the Redis user-cache utilities behind console auth

/api/v1/utils/users/redis exposed open CRUD — create, read, update and delete
on the cached-user store — to anonymous callers. The store is currently empty
and nothing in the console or apps calls it, so closing it breaks no client.

Third of the three route groups flagged in the 2026-07-27 audit. /crm/* stays
open by explicit decision: the field-sales Flutter app sends no credentials.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

routes/routes.go

@@ -359,8 +359,11 @@ func RegisterRoutes(app *fiber.App, cfg *config.Config) {
 
 	hubAuth.Get("/report", controllers.GetHubReport)
 
-	// Redis active user caching utilities
-	redisUsers := api.Group("/utils/users/redis")
+	// Redis active user caching utilities — console/ops only. Open CRUD on a
+	// user cache with no authentication has no legitimate anonymous caller;
+	// the store is currently empty, so closing it breaks nothing.
+	redisUsers := api.Group("/utils/users/redis",
+		middlewares.AuthMiddleware(cfg), middlewares.RoleCheckMiddleware(1, 3, 4))
 	redisUsers.Post("/", controllers.CreateUserRedis)
 	redisUsers.Get("/", controllers.GetUserRedis)
 	redisUsers.Put("/:userid", controllers.UpdateUserRedis)