add password and ip whitelist protection on _diagnostics, stats etc

it is security issue for leak sensitive information

Look for endpoints like _diagnostics and stats in the codebase, likely in HTTP handlers or API routes. Determine how to add password protection and IP whitelisting, possibly using middleware. Check existing authentication or network filtering code for patterns. Verify by testing that sensitive information is no longer accessible without credentials or from unauthorized IPs.

由索引模型根據 Issue 內容生成。