Require admin role for API family reset (#1189)

Prevent non-admin users with read_write API access from triggering family-wide reset jobs via /api/v1/users/reset.

app/controllers/api/v1/users_controller.rb

@@ -2,6 +2,7 @@
 
 class Api::V1::UsersController < Api::V1::BaseController
   before_action :ensure_write_scope
+  before_action :ensure_admin, only: :reset
 
   def reset
     FamilyResetJob.perform_later(Current.family)
@@ -24,4 +25,11 @@ class Api::V1::UsersController < Api::V1::BaseController
     def ensure_write_scope
       authorize_scope!(:write)
     end
+
+    def ensure_admin
+      return true if current_resource_owner&.admin?
+
+      render_json({ error: "forbidden", message: I18n.t("users.reset.unauthorized") }, status: :forbidden)
+      false
+    end
 end