Authenticated credential disclosure via missing endpoint authorization

Incorrect authorization in the Kalmia CMS 0.2.0 users API allows remote authenticated users to retrieve sensitive data for every account. The /kal-api/auth/users path accepts a JWT for a basic read role because middleware/auth.go does not enforce the needed permission, then returns unfiltered records with Blowfish password hashes. A read-only account is sufficient; disclosure is limited to account data and credential material, though the hashes can be cracked offline.