by-code: auth da utente loggato qualunque, come /recipes (#72)

Lo chiama il proxy Flask con la chiave dell'operatore MeasurementTec, quindi
get_current_user al posto di require_admin_user. Test: MeasurementTec 200,
senza chiave 401.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

src/backend/tests/test_stations_api.py

@@ -515,10 +515,18 @@ async def test_station_by_code_unknown_is_404(client: AsyncClient, admin_user):
     assert resp.status_code == 404
 
 
-async def test_station_by_code_requires_admin(client: AsyncClient, maker_user, admin_user):
+async def test_station_by_code_any_authenticated_user(
+    client: AsyncClient, measurement_tec_user, admin_user,
+):
     await client.post(
         "/api/stations", headers=auth_headers(admin_user),
         json={"code": "ST-BA", "name": "BA"},
     )
-    resp = await client.get("/api/stations/by-code/ST-BA", headers=auth_headers(maker_user))
-    assert resp.status_code == 403
+    resp = await client.get("/api/stations/by-code/ST-BA", headers=auth_headers(measurement_tec_user))
+    assert resp.status_code == 200, resp.text
+    assert resp.json()["code"] == "ST-BA"
+
+
+async def test_station_by_code_requires_auth(client: AsyncClient):
+    resp = await client.get("/api/stations/by-code/ST-BA")
+    assert resp.status_code == 401