security: gate analytics/orders/suppliers/customers behind admin JWT; sanitize public order tracking

backend/app/routers/customers.py

@@ -10,10 +10,11 @@ from fastapi import APIRouter, Depends, HTTPException
 from sqlalchemy.orm import Session
 
 from app.database import get_db
+from app.routers.auth import require_admin
 from app.models import Customer
 from app.schemas import CustomerOut, CustomerRegister
 
-router = APIRouter()
+router = APIRouter(dependencies=[Depends(require_admin)])
 
 
 @router.get("", response_model=List[CustomerOut])