[BUG][LOW] Multiple user management endpoints missing authentication check

[kambiz-aghaiepour]

Description

Several user management endpoints lack the @check_access decorator, allowing unauthenticated access:

• GET /api/v3/users/ - list all users
• GET /api/v3/users/<id> - get specific user
• PATCH /api/v3/users/<id> - update user
• POST /api/v3/users/<id>/reset_password - reset password for any user
• GET /api/v3/users/search - search users
• DELETE /api/v3/users/<id> - delete user (has @check_access(["admin"]) but others don't)

Affected Code

• src/quads/server/blueprints/users.py:52-117,119-143,145-159,161-189,191-204

Impact

• Information disclosure of all user accounts
• Unauthorized user modification
• Ability to reset any user's password

Recommended Fix

Add @check_access(["admin"]) to all user management endpoints that should be restricted, or @check_access([]) (authenticated) for self-service endpoints.

[sadsfae]

Some of these endpoints are open by design, this doesn't necessarily comprise a security concern. I don't know the IDP structure well enough to be sure - cc: @grafuls

[grafuls]

All GETs are open by design but those PATCH POST and DELETE were recently introduced and should have the @check_access decorator