Sensitive-data exposure and modification via unguarded admin APIs

Authorization bypasses in FOSSBilling before 0.8.0 allow remote authenticated users to read and alter protected data via admin APIs. The Staff service's can_always_access flag bypasses module permissions, while admin handlers omit endpoint checks or trust attacker-controlled object identifiers. A staff login without management rights is sufficient to disclose settings and decrypted extension secrets, alter bank and language data, trigger cron work, or terminate arbitrary sessions.