undo skipped tests, only allow API calls for admin-views, refactor viewer-page to use page.server

src/routes/api/list/+server.ts

@@ -1,7 +1,10 @@
 import { getVorgaenge } from '$lib/server/vorgangService';
+import { json } from '@sveltejs/kit';
 
 export async function GET({ locals }) {
-
+	if (!locals.user) {
+		return json({ error: 'Unauthorized' }, { status: 401 });
+	}
 	const vorgaenge = getVorgaenge();
 
 	return new Response(JSON.stringify(vorgaenge), {