fix(api): limit script-info to users who may add devices

The endpoint returns the device registration token and the TURN
credentials, but only required a login. Gate it on device.write, which
is what the "add device" entry in the UI already checks.

Signed-off-by: GL.iNet-Yongping.Xie <yongping.xie@gl-inet.com>

internal/http/router.go

@@ -71,8 +71,8 @@ func RegisterAPIRoutes(r *gin.Engine, d Deps) {
     api := r.Group("/api")
     api.Use(middleware.Auth(d.SessionStore, d.UserSvc, d.PermSvc))
 
-    // device script info (requires login)
-    api.GET("/script-info", func(c *gin.Context) {
+    // device script info (admin only: it returns the device token and TURN credentials)
+    api.GET("/script-info", middleware.Require(permission.DeviceWrite), func(c *gin.Context) {
         traceID := middleware.GetTraceID(c)
 
         // Get domain info