GHSA-7q9c-hpx7-9cwm: TypeSpec: Unauthenticated Remote Shutdown of Spector Mock Server via POST /.admin/stop

@typespec/spector registers a POST /.admin/stop HTTP route with no authentication, authorization token, Origin check, or IP-source restriction. Any network-reachable client can send a single unauthenticated POST request to terminate the mock server process. Because the server binds to 0.0.0.0 by default (all interfaces), this endpoint is exposed to any host that can reach the server’s port—not just localhost—making a complete denial-of-service trivially achievable with one HTTP request. Severity is High (CVSS 7.5).