Restricted plugin and school-system management endpoints to administrators (#210)

Author: PianoNic

src/Schuly.API/Controllers/PluginsController.cs

@@ -10,6 +10,7 @@ namespace Schuly.API.Controllers
 {
     [ApiController]
     [Route("api/[controller]")]
+    [Authorize(Roles = "Administrator")]
     public class PluginsController(IMediator mediator, PluginSchedulerRegistry scheduler, PluginManager plugins) : ControllerBase
     {
         [HttpGet]

src/Schuly.API/Controllers/SchoolSystemsController.cs

@@ -9,7 +9,7 @@ namespace Schuly.API.Controllers
 {
     [ApiController]
     [Route("api/[controller]")]
-    [Authorize]
+    [Authorize(Roles = "Administrator")]
     public class SchoolSystemsController(IMediator mediator) : ControllerBase
     {
         [HttpGet]