by-code: auth da utente loggato qualunque, come /recipes (#72)

Lo chiama il proxy Flask con la chiave dell'operatore MeasurementTec, quindi
get_current_user al posto di require_admin_user. Test: MeasurementTec 200,
senza chiave 401.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

src/backend/api/routers/stations.py

@@ -70,10 +70,10 @@ async def create_new_station(
 @router.get("/by-code/{code}", response_model=StationResponse)
 async def get_station_by_code(
     code: str,
-    admin: User = Depends(require_admin_user),
+    user: User = Depends(get_current_user),
     db: AsyncSession = Depends(get_db),
 ):
-    """Get a station by its code (admin only, like GET /{station_id}) (#72)."""
+    """Get a station by its code (any authenticated user, like /by-code/{code}/recipes) (#72)."""
     station = await station_service.get_station_by_code(db, code)
     if station is None:
         raise HTTPException(

src/backend/tests/test_stations_api.py

@@ -515,10 +515,18 @@ async def test_station_by_code_unknown_is_404(client: AsyncClient, admin_user):
     assert resp.status_code == 404
 
 
-async def test_station_by_code_requires_admin(client: AsyncClient, maker_user, admin_user):
+async def test_station_by_code_any_authenticated_user(
+    client: AsyncClient, measurement_tec_user, admin_user,
+):
     await client.post(
         "/api/stations", headers=auth_headers(admin_user),
         json={"code": "ST-BA", "name": "BA"},
     )
-    resp = await client.get("/api/stations/by-code/ST-BA", headers=auth_headers(maker_user))
-    assert resp.status_code == 403
+    resp = await client.get("/api/stations/by-code/ST-BA", headers=auth_headers(measurement_tec_user))
+    assert resp.status_code == 200, resp.text
+    assert resp.json()["code"] == "ST-BA"
+
+
+async def test_station_by_code_requires_auth(client: AsyncClient):
+    resp = await client.get("/api/stations/by-code/ST-BA")
+    assert resp.status_code == 401