feat(settings): restrict AI readiness checks to admins

packages/api/src/router/assistant.ts

@@ -344,6 +344,7 @@ const ADMIN_ONLY_TOOLS = new Set([
   "commit_dispo_import_batch",
   "get_system_settings",
   "update_system_settings",
+  "get_ai_configured",
   "test_ai_connection",
   "test_smtp_connection",
   "test_gemini_connection",

packages/api/src/router/settings.ts

@@ -1,5 +1,5 @@
 import { z } from "zod";
-import { adminProcedure, createTRPCRouter, protectedProcedure } from "../trpc.js";
+import { adminProcedure, createTRPCRouter } from "../trpc.js";
 import { createAiClient, isAiConfigured, parseAiError } from "../ai-client.js";
 import { DEFAULT_SUMMARY_PROMPT } from "./resource.js";
 import { VALUE_SCORE_WEIGHTS } from "@capakraken/shared";
@@ -361,7 +361,7 @@ export const settingsRouter = createTRPCRouter({
     }
   }),
 
-  getAiConfigured: protectedProcedure.query(async ({ ctx }) => {
+  getAiConfigured: adminProcedure.query(async ({ ctx }) => {
     const settings = await ctx.db.systemSettings.findUnique({
       where: { id: "singleton" },
       select: {