[Frontend] Authenticate analytics proxy API routes

## Problem

Analytics routes proxy potentially sensitive operational and user data but need a consistent server authorization layer.

## Relevant code

`src/pages/api/analytics`

## Proposed scope

Require appropriate roles, validate parameters, forward identity safely, and test unauthenticated and cross-role requests.

## Acceptance criteria

- [ ] The reported behavior is reproduced or characterized with a focused automated test before the fix.
- [ ] The implementation satisfies the proposed scope without weakening TypeScript, lint, authorization, privacy, or error handling.
- [ ] Success, empty/loading where applicable, failure, and boundary cases are covered.
- [ ] Existing related tests pass and new regression coverage is included.
- [ ] User-facing behavior remains accessible by keyboard and at mobile viewport sizes where UI is affected.
- [ ] Documentation is updated when the change alters configuration, contracts, security assumptions, or contributor workflow.

## Contributor notes

Base the work on the latest `main` branch. Keep unrelated refactors out of the pull request and include screenshots or recordings for visible changes. Never use real pet, medical, contact, wallet, or credential data in fixtures.

Start by reading the route handlers under src/pages/api/analytics and identify their existing authorization, parameter validation, and identity-forwarding behavior. Reproduce unauthenticated and cross-role requests with focused automated tests, then verify success, empty, failure, and boundary cases while keeping related tests passing.

Written by the indexing model from the issue text.