fix: restrict user email visibility

Co-Authored-By: gpt-5.6-sol <noreply@openai.com>

test/backends/api/index.test.ts

@@ -17,7 +17,9 @@ async function getApiDb() {
     email: AUTH_EMAIL,
     name: "API Auth User",
     password: pw,
-    flags: {},
+    // The shared backend contract suite exercises unrestricted user lookup,
+    // which the HTTP API now reserves for global administrators.
+    flags: { admin: true },
   });
   const server = await createTestServer(sqliteDb);
   const authHeader = "Basic " + btoa(`${AUTH_EMAIL}:${AUTH_PASSWORD}`);