GHSA-4h9q-p5j4-xvvh: Ech0: Scoped admin access tokens can bypass least-privilege controls on privileged endpoints, including backup export

Ech0 scoped access tokens do not reliably enforce least privilege: multiple privileged admin routes omit scope checks, and the backup export handler strips token scope metadata entirely, allowing a low-scope admin access token to reach broader admin functionality than intended.