[安全性] 多个 CRITICAL 授权漏洞（未经过身份验证的计划激活、SUDOERS JWT 撤销绕过、VPN 凭证泄露）

Finding 1 — [CRITICAL] Authentication Bypass — Unauthenticated Plan Activation

Location: app/routers/user.py:272-275 (active_next_plan)

The active_next_plan endpoint performs a state-changing operation — it activates a user's next plan, resets their traffic to zero, changes their data_limit and expire, and re-enables them in xray — but it lacks the admin: Admin = Depends(Admin.get_current) dependency that every other mutation endpoint in the same router requires.