fix(usage): block remote refresh without auth

src/web-server/usage/routes.ts

@@ -8,6 +8,7 @@
  */
 
 import { Router } from 'express';
+import { requireLocalAccessWhenAuthDisabled } from '../middleware/auth-middleware';
 import {
   handleSummary,
   handleDaily,
@@ -24,6 +25,20 @@ export { prewarmUsageCache, clearUsageCache, getLastFetchTimestamp } from './agg
 
 export const usageRoutes = Router();
 
+const USAGE_WRITE_ACCESS_ERROR =
+  'Usage refresh requires localhost access when dashboard auth is disabled.';
+
+usageRoutes.use((req, res, next) => {
+  if (req.method.toUpperCase() !== 'POST') {
+    next();
+    return;
+  }
+
+  if (requireLocalAccessWhenAuthDisabled(req, res, USAGE_WRITE_ACCESS_ERROR)) {
+    next();
+  }
+});
+
 // Summary endpoint
 usageRoutes.get('/summary', handleSummary);