fix(measurements): export CSV ammette admin senza ruolo esplicito (#36 punto 3)

Il controllo ruolo di GET /api/measurements/export/csv ignorava is_admin:
un admin senza MeasurementTec/Metrologist assegnato prendeva 403, a
differenza di ogni altro endpoint che passa da require_role (ruolo o admin).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/backend/tests/test_measurements.py

@@ -10,7 +10,7 @@ from src.backend.models.orm.user import User
 from src.backend.models.orm.recipe import RecipeVersion
 from src.backend.models.orm.task import RecipeTask, RecipeSubtask
 from src.backend.services import auth_service
-from src.backend.tests.conftest import auth_headers, create_test_recipe
+from src.backend.tests.conftest import _create_user, auth_headers, create_test_recipe
 
 
 async def _get_subtask_and_version(
@@ -648,7 +648,34 @@ class TestMeasurementStatistics:
 
 
 class TestExportCsv:
-    """GET /api/measurements/export/csv tests (gitea#22)."""
+    """GET /api/measurements/export/csv tests (gitea#22, gitea#36 point 3)."""
+
+    async def test_admin_without_explicit_role_can_export(
+        self, client: AsyncClient, db_session: AsyncSession,
+    ):
+        """An admin with no MeasurementTec/Metrologist role must not get 403 (#36.3).
+
+        admin_user (conftest) already has both roles, which would pass even
+        without the fix: a bare admin (roles=[]) is the actual regression case.
+        """
+        bare_admin = await _create_user(
+            db_session, username="bare_admin", roles=[], is_admin=True,
+        )
+        resp = await client.get(
+            "/api/measurements/export/csv",
+            headers=auth_headers(bare_admin),
+        )
+        assert resp.status_code == 200
+
+    async def test_maker_without_role_still_forbidden(
+        self, client: AsyncClient, maker_user: User,
+    ):
+        """A plain Maker (no MeasurementTec/Metrologist/admin) still gets 403."""
+        resp = await client.get(
+            "/api/measurements/export/csv",
+            headers=auth_headers(maker_user),
+        )
+        assert resp.status_code == 403
 
     async def test_lot_number_formula_is_neutralised(
         self,