Add security fixes and code cleanup for PyPI cache

- Add require_admin authentication to cache management endpoints
- Add limit validation (1-500) on failed tasks query
- Add thread lock for worker pool thread safety
- Fix exception handling with separate recovery DB session
- Remove obsolete design doc

backend/app/pypi_proxy.py

@@ -15,12 +15,13 @@ from typing import Optional, List, Tuple
 from urllib.parse import urljoin, urlparse, quote, unquote
 
 import httpx
-from fastapi import APIRouter, BackgroundTasks, Depends, HTTPException, Request, Response
+from fastapi import APIRouter, BackgroundTasks, Depends, HTTPException, Query, Request, Response
 from fastapi.responses import StreamingResponse, HTMLResponse
 from sqlalchemy.orm import Session
 
+from .auth import require_admin
 from .database import get_db
-from .models import UpstreamSource, CachedUrl, Artifact, Project, Package, Tag, PackageVersion, ArtifactDependency
+from .models import User, UpstreamSource, CachedUrl, Artifact, Project, Package, Tag, PackageVersion, ArtifactDependency
 from .storage import S3Storage, get_storage
 from .config import get_env_upstream_sources
 from .pypi_cache_worker import (
@@ -814,25 +815,32 @@ async def pypi_download_file(
 
 
 @router.get("/cache/status")
-async def pypi_cache_status(db: Session = Depends(get_db)):
+async def pypi_cache_status(
+    db: Session = Depends(get_db),
+    _current_user: User = Depends(require_admin),
+):
     """
     Get summary of the PyPI cache task queue.
 
     Returns counts of tasks by status (pending, in_progress, completed, failed).
+    Requires admin privileges.
     """
     return get_cache_status(db)
 
 
 @router.get("/cache/failed")
 async def pypi_cache_failed(
-    limit: int = 50,
+    limit: int = Query(default=50, ge=1, le=500),
     db: Session = Depends(get_db),
+    _current_user: User = Depends(require_admin),
 ):
     """
     Get list of failed cache tasks for debugging.
 
     Args:
-        limit: Maximum number of tasks to return (default 50).
+        limit: Maximum number of tasks to return (default 50, max 500).
+
+    Requires admin privileges.
     """
     return get_failed_tasks(db, limit=limit)
 
@@ -841,12 +849,15 @@ async def pypi_cache_failed(
 async def pypi_cache_retry(
     package_name: str,
     db: Session = Depends(get_db),
+    _current_user: User = Depends(require_admin),
 ):
     """
     Reset a failed cache task to retry.
 
     Args:
         package_name: The package name to retry.
+
+    Requires admin privileges.
     """
     task = retry_failed_task(db, package_name)
     if not task:
@@ -858,11 +869,15 @@ async def pypi_cache_retry(
 
 
 @router.post("/cache/retry-all")
-async def pypi_cache_retry_all(db: Session = Depends(get_db)):
+async def pypi_cache_retry_all(
+    db: Session = Depends(get_db),
+    _current_user: User = Depends(require_admin),
+):
     """
     Reset all failed cache tasks to retry.
 
     Returns the count of tasks that were reset.
+    Requires admin privileges.
     """
     count = retry_all_failed_tasks(db)
     return {"message": f"Queued {count} tasks for retry", "count": count}