Restrict backend selection to admins

An empty `backend` form field now correctly falls back to the default. A
non-empty field submitted by a non-admin user is rejected with a 403
error, preventing potential tampering or issues arising from stale
sessions after role changes.

server/src/routes/case_actions.rs

@@ -57,7 +57,8 @@ impl HasCsrfToken for AnalyzeForm {
 /// `analysis_input_v1.json`; otherwise writes `analysis_input_v{N+1}.json`
 /// where N is the current latest document version. The worker picks up the
 /// new input and produces `document_v{version}.md`. Available to all logged-in
-/// users (no admin check). Race protection via `create_new` on the input file.
+/// users; the optional `backend` form field is admin-only. Race protection
+/// via `create_new` on the input file.
 pub async fn handle_analyze_case(
     user: AuthenticatedWebUser,
     State(config): State<Arc<Config>>,
@@ -72,6 +73,13 @@ pub async fn handle_analyze_case(
         ));
     }
 
+    // Backend selection is admin-only. A non-empty field on a non-admin
+    // session indicates tampering or a stale tab after a role downgrade,
+    // and is rejected with 403 instead of silently falling back to default.
+    if !form.backend.is_empty() && !user.is_admin() {
+        return Err(AppError::Forbidden("Backend-Wahl nur für Admins".into()));
+    }
+
     // Resolve the requested backend. Empty string falls back to the default
     // backend; an unknown id is rejected as a 400 so the user notices the
     // misconfiguration instead of silently getting a different model.