Discovered During
Code review of PR #3416.
Problem
All 7 new endpoints in autobot-backend/api/slm/deployments.py have no authentication dependency. Every other sensitive API uses Depends(get_current_user) from auth_middleware, but the new deployment routes do not — any unauthenticated caller can trigger, cancel, or roll back Docker deployments.
Fix
Add current_user: dict = Depends(get_current_user) to each route handler, or as a router-level dependency:
router = APIRouter(dependencies=[Depends(get_current_user)])