security: gate analytics/orders/suppliers/customers behind admin JWT; sanitize public order tracking

backend/app/routers/analytics.py

@@ -12,9 +12,10 @@ from sqlalchemy import func
 from sqlalchemy.orm import Session
 
 from app.database import get_db
+from app.routers.auth import require_admin
 from app.models import Order, Supplier, SupplierPerformance
 
-router = APIRouter()
+router = APIRouter(dependencies=[Depends(require_admin)])
 
 EXCLUDED = ["cancelled", "refunded"]