fix: harden auth site access and SSH validation

backend/src/routes/topology.ts

@@ -2,7 +2,7 @@ import { Router, Request, Response } from 'express';
 import { query, queryOne } from '../config/database';
 import { requireAuth, requireWrite } from '../middleware/auth';
 import { siteScopeDevices, siteScopeByDevice } from '../utils/siteScope';
-import { activeSite } from '../middleware/site';
+import { activeSite, enforceSiteAccess } from '../middleware/site';
 import { PollerService } from '../services/PollerService';
 import {
   buildTopology,
@@ -13,6 +13,7 @@ import {
 
 const router = Router();
 router.use(requireAuth);
+router.use(enforceSiteAccess);
 
 let pollerService: PollerService | null = null;
 export function setPollerService(p: PollerService): void {