security: protect proxmox api endpoints with session authentication

- Added authentication checks to pve_action.php and pve_list.php
- Require valid logged-in session before API access
- Restrict Proxmox actions to admin users only
- Return HTTP 401 for unauthenticated requests
- Return HTTP 403 for unauthorized users
- Keep existing API logic unchanged

api/pve_action.php

@@ -1,4 +1,19 @@
 <?php
+require_once __DIR__ . '/../config/session.php';
+
+if (!isset($_SESSION['loggedin']) || $_SESSION['loggedin'] !== true) {
+    http_response_code(401);
+    header('Content-Type: application/json; charset=utf-8');
+    echo json_encode(['ok' => false, 'error' => 'Unauthorized']);
+    exit;
+}
+if (($_SESSION['role'] ?? 'user') !== 'admin') {
+    http_response_code(403);
+    header('Content-Type: application/json; charset=utf-8');
+    echo json_encode(['ok' => false, 'error' => 'Forbidden']);
+    exit;
+}
+
 require_once __DIR__ . '/../lib/PveApi.php';
 $cfg = require __DIR__ . '/../config/pve.php';
 $pve = new PveApi($cfg);
@@ -15,7 +30,6 @@ try {
     $vmid = (int)($_POST['vmid'] ?? 0);
     $action = (string)($_POST['action'] ?? '');
 
-  // optional: hier deine Dashboard-Auth checken!
     if ($vmid <= 0) throw new InvalidArgumentException("vmid fehlt/ungültig");
 
     $upid = $pve->powerAction($vmid, $action);

api/pve_list.php

@@ -1,4 +1,18 @@
 <?php
+require_once __DIR__ . '/../config/session.php';
+
+if (!isset($_SESSION['loggedin']) || $_SESSION['loggedin'] !== true) {
+    http_response_code(401);
+    header('Content-Type: application/json; charset=utf-8');
+    echo json_encode(['ok' => false, 'error' => 'Unauthorized']);
+    exit;
+}
+if (($_SESSION['role'] ?? 'user') !== 'admin') {
+    http_response_code(403);
+    header('Content-Type: application/json; charset=utf-8');
+    echo json_encode(['ok' => false, 'error' => 'Forbidden']);
+    exit;
+}
 
 require_once __DIR__ . '/../lib/PveApi.php';
 $cfg = require __DIR__ . '/../config/pve.php';
@@ -7,8 +21,8 @@ $pve = new PveApi($cfg);
 header('Content-Type: application/json; charset=utf-8');
 
 try {
-  $lxcs = $pve->listLxc();   // array mit vmid, name, status, cpu, mem, etc.
-  $vms  = $pve->listQemu();  // array mit vmid, name, status, cpu, mem, etc.
+    $lxcs = $pve->listLxc();
+    $vms  = $pve->listQemu();
 
     $all = [];
 
@@ -44,7 +58,6 @@ try {
         }
     }
 
-  // Sort: erst LXCs, dann VMs oder nach vmid
     usort($all, fn($a, $b) => $a['vmid'] <=> $b['vmid']);
 
     echo json_encode(['ok' => true, 'items' => $all], JSON_UNESCAPED_UNICODE);