PT-2026-128248

NORA is a self-hosted artifact registry and pull-through cache. Prior to 0.9.5, nora-registry authenticates the token-management UI but fails to require administrator authorization. auth middleware protects /ui/tokens and /api/ui/tokens, but state-changing requests are checked only with role.can...