4d03676e60
/api/v1/bookings/cache/* was open "for testing" but is live in production: listing it returns real bookings including customer delivery addresses, and /customer/:customer_id takes the customer straight from the URL, so anyone could enumerate a given customer's bookings without credentials. Now requires a console token (roles 1/3/4), matching the rest of the admin surface. The /crm/* group stays open by deliberate decision — the field-sales Flutter app authenticates with nothing and would break; revisit when that app can send a key. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>