Harden app security controls from audit

Endpoints/AdminEndpoints.cs

@@ -2,6 +2,7 @@ using GameList.Data;
 using GameList.Contracts;
 using Microsoft.AspNetCore.Mvc;
 using GameList.Infrastructure;
+using Microsoft.AspNetCore.RateLimiting;
 
 namespace GameList.Endpoints;
 
@@ -9,7 +10,7 @@ public static class AdminEndpoints
 {
     public static void MapAdminEndpoints(this IEndpointRouteBuilder app)
     {
-        var admin = app.MapGroup("/api/admin").RequireAuthorization().AddEndpointFilter<AdminOnlyFilter>();
+        var admin = app.MapGroup("/api/admin").RequireAuthorization().RequireRateLimiting("admin-sensitive").AddEndpointFilter<AdminOnlyFilter>();
 
         admin.MapPost("/results", async ([FromBody] ResultsOpenRequest request, AdminWorkflowService service) => await service.SetResultsOpenAsync(request.ResultsOpen));
 
@@ -25,7 +26,7 @@ public static class AdminEndpoints
             if (player is null)
                 return EndpointHelpers.UnauthorizedError();
 
-            return await service.DeletePlayerAsync(playerId, player.Id, request.Password);
+            return await service.DeletePlayerAsync(playerId, player.Id, request.Password, ctx);
         });
 
         admin.MapPost("/link-suggestions", async ([FromBody] LinkSuggestionsRequest request, HttpContext ctx, AppDbContext db, AdminWorkflowService service) =>
@@ -52,7 +53,7 @@ public static class AdminEndpoints
             if (player is null)
                 return EndpointHelpers.UnauthorizedError();
 
-            return await service.ResetAsync(player.Id, request.Password);
+            return await service.ResetAsync(player.Id, request.Password, ctx);
         });
 
         admin.MapPost("/factory-reset", async ([FromBody] AdminPasswordRequest request, HttpContext ctx, AppDbContext db, AdminWorkflowService service) =>
@@ -61,7 +62,7 @@ public static class AdminEndpoints
             if (player is null)
                 return EndpointHelpers.UnauthorizedError();
 
-            return await service.FactoryResetAsync(player.Id, request.Password);
+            return await service.FactoryResetAsync(player.Id, request.Password, ctx);
         });
     }
 }