Make table-config an admin-only REST endpoint

[robinskil]

Summary

GET /api/table-config returns a table's storage format, location, and options — which for external SQL-database tables can include connection details. It previously lived in the public client router with no authentication. This PR moves it into the admin router (gated by the existing basic_auth middleware) at GET /api/admin/table-config, so table configuration is admin-only.

Changes

API

• New beacon-api/src/axum/admin/tables.rs — list_table_config handler tagged admin, security(("basic-auth" = [])), returns 404 on a missing table. Registered in the admin router.
• Removed the handler + ListTableConfigQuery + route from the client surface (client/tables.rs, client/mod.rs); trimmed the tables/admin OpenAPI tag descriptions.
• Credential redaction in TableConfigView::try_from (beacon-core/src/api.rs) is unchanged as defense-in-depth; reworded its now-inaccurate "public endpoint" comments.

Tests

• integration-tests/test_sql_databases.py: the redaction test now calls /api/admin/table-config with admin auth, and additionally asserts an unauthenticated call returns 401.

Docs (VitePress, docs/docs/1.7.3/)

• data-lake/sql-databases.md + api/exploring-data-lake.md: updated all references to the admin path/auth.
• Audited the REST API docs against the live surface: added the missing example requests for the admin check/crawlers endpoints so every endpoint has a runnable example, and flagged the deprecated /api/datasets and /api/query/available-columns aliases.

Out of scope

• The Python CLI client (clients/beacon-cli/.../client.py) still targets the old /api/table-config path and will 404 until updated separately.

Verification

• cargo build -p beacon-api ✅
• cargo test -p beacon-api ✅ (10 passed)
• cargo test -p beacon-core table_config_redaction ✅

[Copilot]

Pull request overview

This PR secures table configuration inspection by removing GET /api/table-config from the unauthenticated client surface and reintroducing it as an authenticated admin endpoint at GET /api/admin/table-config behind the existing HTTP Basic auth middleware, reducing the risk of leaking sensitive external-table configuration details.

Changes:

• Moved the table-config handler from the client router to a new admin router handler (/api/admin/table-config) protected by basic_auth.
• Updated integration tests to assert unauthenticated access is rejected (401) and that SQL credentials remain redacted.
• Updated VitePress docs to reference the new admin-only endpoint and added/expanded runnable admin endpoint examples.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
integration-tests/test_sql_databases.py	Updates redaction test to call the new admin endpoint and assert 401 without auth.
docs/docs/1.7.3/data-lake/sql-databases.md	Updates endpoint references to /api/admin/table-config and clarifies admin auth requirement.
docs/docs/1.7.3/api/exploring-data-lake.md	Updates table-config docs to admin-only, adds deprecated alias note, and expands runnable admin examples.
beacon-core/src/api.rs	Rewords comments/tests to reflect the endpoint is now admin-only while keeping redaction behavior unchanged.
beacon-api/src/axum/client/tables.rs	Removes the public list_table_config handler and associated query params type.
beacon-api/src/axum/client/mod.rs	Removes the table-config route and trims the tables tag description accordingly.
beacon-api/src/axum/admin/tables.rs	Adds the new admin list_table_config handler for /api/admin/table-config.
beacon-api/src/axum/admin/mod.rs	Registers the new admin tables module/route and updates the admin OpenAPI tag description.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.